Versions (4)
Version DetailsCurrent
Rev: 4 • Mar 7, 2015, 12:00 PMET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct M1 Feb 06 2015
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Malicious Second Stage Download URI Struct M1 Feb 06 2015"; flow:established,to_server; content:".php?id="; http_uri; fast_pattern; content:"&rnd="; http_uri; pcre:"/\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$/U"; classtype:exploit-kit; sid:2020643; rev:4; metadata:created_at 2015_03_07, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_08;)
Mar 7, 2015, 12:00 PM
Oct 8, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 6, 2025, 4:34 PM
rules/emerging-exploit_kit.rules