Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING FancyBear/APT28 Related Phish Landing Page 2022-03-08"; flow:established,to_client; http.response_line; content:"HTTP/1.1 200 OK"; file.data; content:"|22|https|3a 2f 2f|webhook.site/3cc37709-f3bd-47bf-8b79-f090f0e8075b"; fast_pattern; reference:url,blog.google/threat-analysis-group/update-threat-landscape-ukraine/; classtype:credential-theft; sid:2035405; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, deployment SSLDecrypt, malware_family APT28, malware_family Fancy_Bear, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_02;)