Back to Rule

Rule History

SID: 2020719 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 6Mar 20, 2015, 12:00 PM

ET EXPLOIT_KIT Possible HanJuan Landing March 20 2015

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible HanJuan Landing March 20 2015"; flow:established,to_client; http.server; content:"nginx"; startswith; http.content_type; content:"text/html"; startswith; file.data; content:!"<body>"; content:!"<html>"; content:"<script>"; startswith; pcre:"/^\s*[a-z]+\s*?=\s*?(?P<q1>[\x22\x27])(?:(?!(?P=q1)).)+?(?P=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*?=\s*?(?P<q2>[\x22\x27])(?:(?!(?P=q2)).)+?(?P=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr/Rs"; content:"]/g,|27 27|).substr|28|"; fast_pattern; classtype:exploit-kit; sid:2020719; rev:6; metadata:created_at 2015_03_20, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_03;)

Mar 20, 2015, 12:00 PM

Mar 3, 2024, 12:00 PM

Sep 21, 2024, 3:00 AM

Oct 8, 2025, 9:38 PM

rules/emerging-exploit_kit.rules