Versions (4)
Version DetailsCurrent
Rev: 4 • May 22, 2015, 12:00 PMET EXPLOIT_KIT DNSChanger EK Landing URI Struct May 22 2015
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DNSChanger EK Landing URI Struct May 22 2015"; flow:to_server,established; content:"GET"; http_method; content:"/stat/load"; http_uri; fast_pattern; content:".php"; http_uri; http_start; pcre:"/^GET\s*?\/stat\/load(?=(?-i)[a-z0-9]*?[A-Z])(?=(?-i)[A-Z0-9]*?[a-z])(?P<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(?P=hname)\./smi"; classtype:exploit-kit; sid:2021141; rev:4; metadata:created_at 2015_05_22, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_02_10;)
May 22, 2015, 12:00 PM
Feb 10, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 8, 2025, 10:34 PM
rules/emerging-exploit_kit.rules