Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Malicious Redirect Leading to EK Dec 08 2014"; flow:established,to_client; http.header; content:"Content-Type|3a 20 0d 0a|"; fast_pattern; content:"Last-Modified|3a 20|"; pcre:"/^Last-Modified\x3a\x20[^A-Za-z]{2}/m"; file.data; content:"<meta http-equiv=|22|refresh|22| content=|22|0|3b| url="; classtype:exploit-kit; sid:2019895; rev:3; metadata:created_at 2014_12_09, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)