Versions (4)
Version DetailsCurrent
Rev: 6 • Mar 20, 2015, 12:00 PMET EXPLOIT_KIT Possible HanJuan Landing March 20 2015
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible HanJuan Landing March 20 2015"; flow:established,to_client; http.server; content:"nginx"; startswith; http.content_type; content:"text/html"; startswith; file.data; content:!"<body>"; content:!"<html>"; content:"<script>"; startswith; pcre:"/^\s*[a-z]+\s*?=\s*?(?P<q1>[\x22\x27])(?:(?!(?P=q1)).)+?(?P=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*?=\s*?(?P<q2>[\x22\x27])(?:(?!(?P=q2)).)+?(?P=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr/Rs"; content:"]/g,|27 27|).substr|28|"; fast_pattern; classtype:exploit-kit; sid:2020719; rev:6; metadata:created_at 2015_03_20, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_03;)
Mar 20, 2015, 12:00 PM
Mar 3, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 8, 2025, 9:38 PM
rules/emerging-exploit_kit.rules