Rule History

SID: 2031803 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Mar 3, 2021, 12:00 PM

Message:

ET HUNTING Hidden embedded HTML Document

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Hidden embedded HTML Document"; flow:established,to_client; file.data; content:"<embed src=|27|data|3a|text/html|3b|base64|2c|PCFET0NUWVBFIGh0bWw+"; content:"|27 20|height|3d 27|0|27 20|frameborder|3d 27|0|27 3e 3c 2f|embed|3e|"; within:6000; reference:url,cujo.com/dns-hijacking-attacks-on-home-routers-in-brazil/; classtype:bad-unknown; sid:2031803; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_03, deployment Perimeter, confidence Medium, signature_severity Informational, updated_at 2021_03_03;)

Created:

Mar 3, 2021, 12:00 PM

Updated:

Mar 3, 2021, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 21, 2024, 3:00 AM

Filename:

rules/emerging-hunting.rules