Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Phishing Landing Obfuscation 2016-02-26"; flow:established,to_client; http.stat_code; content:"200"; http.content_type; content:"text/html"; http.content_len; byte_test:0,<,8192,0,string,dec; file.data; content:"eval|28|unescape|28 27|"; content:"%66%75%6e%63%74%69%6f%6e"; distance:0; content:"%7b%0a%09%76%61%72%20"; distance:0; content:"%0a%09%76%61%72%20%74%6d%70%20%3d%20%73%2e%73%70%6c%69%74%28%22"; pcre:"/^(\%[0-9]{2}){8}%22/R"; content:"%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%30%5d%29%3b%0a%09%6b%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%31%5d%20%2b%20%22"; distance:0; pcre:"/^(\%[0-9]{2}){6}%22%29%3b%0a%09/R"; content:"%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%28%70%61%72%73%65%49%6e%74%28"; distance:0; fast_pattern; content:"eval|28|unescape|28 27|%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65"; distance:0; content:"unescape|28 27|%27%29%29%3b|27 29 29 3b|"; distance:0; reference:url,www.proofpoint.com/sites/default/files/proofpoint-obfuscation-techniques-phishing-attacks-threat-insight-en-v1.pdf; classtype:social-engineering; sid:2032372; rev:5; metadata:attack_target Client_Endpoint, created_at 2016_02_26, deployment Perimeter, confidence Medium, signature_severity Critical, tag Phishing, updated_at 2023_12_14, reviewed_at 2024_04_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)