Versions (4)
Version DetailsCurrent
Rev: 3 • Mar 6, 2017, 12:00 PMET DELETED Successful Vanguard Phish Mar 06 2017
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Successful Vanguard Phish Mar 06 2017"; flow:to_server,established; content:"POST"; http_method; content:"dmform-0="; depth:9; nocase; http_client_body; content:"&label-dmform-0=User+name"; nocase; distance:0; http_client_body; content:"&label-dmform-1=Password"; nocase; distance:0; http_client_body; content:"&label-dmform-8=Account+Email"; nocase; distance:0; http_client_body; content:"&label-dmform-9=Password"; nocase; distance:0; http_client_body; content:"&dmformsubject=Vang"; nocase; distance:0; http_client_body; fast_pattern; classtype:credential-theft; sid:2024032; rev:3; metadata:created_at 2017_03_06, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_09_06;)
Mar 6, 2017, 12:00 PM
Sep 6, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Nov 20, 2025, 10:34 PM
rules/emerging-deleted.rules