Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely CottonCastle/Niteris EK Response June 19 2015"; flow:established,to_client; http.header; content:"Refresh|3a 20|"; content:"|3b 20|url"; distance:0; content:"/999/00000/|0d 0a|"; distance:0; fast_pattern; pcre:"/^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/m"; classtype:exploit-kit; sid:2021306; rev:3; metadata:created_at 2015_06_19, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)