Versions (3)
Version DetailsCurrent
Rev: 4 • Apr 9, 2015, 12:00 PMET EXPLOIT Known Malicious Router DNS Change GET Request
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Known Malicious Router DNS Change GET Request"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/router/add_dhcp_segment.cgi?"; fast_pattern; content:"is_router_as_dns=1"; content:"&dns1="; content:"submitbutton="; reference:url,wepawet.cs.ucsb.edu/view.php?hash=5e14985415814ed1e107c0583a27a1a2&t=1384961238&type=js; classtype:attempted-admin; sid:2020877; rev:4; metadata:created_at 2015_04_09, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_30;)
Apr 9, 2015, 12:00 PM
Sep 30, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 13, 2025, 9:34 PM
rules/emerging-exploit.rules