Versions (5)
Version DetailsCurrent
Rev: 2 • Dec 9, 2014, 12:00 PMET EXPLOIT_KIT Malicious Iframe Leading to EK Dec 08 2014
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Malicious Iframe Leading to EK Dec 08 2014"; flow:established,from_server; file_data; content:"document.write(|22|<iframe name=|27|"; within:30; pcre:"/^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+/R"; content:"frameborder=0 marginheight=0 marginwidth=0 scrolling=no"; content:"</|22| + |22|iframe>|22|)|3b|"; fast_pattern; isdataat:!3,relative; classtype:exploit-kit; sid:2019892; rev:2; metadata:created_at 2014_12_09, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Dec 9, 2014, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Nov 7, 2025, 9:34 PM
rules/emerging-exploit_kit.rules