Versions (2)
Version DetailsCurrent
Rev: 2 • Aug 28, 2023, 12:00 PMET HUNTING Base64 Encoded ISO File in HTML Body (Magic Bytes)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Base64 Encoded ISO File in HTML Body (Magic Bytes)"; flow:established,to_client; flowbits:set,et.exploitkitlanding; file_data; content:"Q0QwMD"; fast_pattern; content:"DRDAwM"; distance:2725; within:100; content:"NEMDAx"; distance:2725; within:100; reference:url,urlscan.io/result/98d7e72b-67b8-4d7c-9735-c27525b0a550/#transactions; classtype:misc-activity; sid:2047788; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_08_28, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag HTML_Smuggling, updated_at 2023_10_10, reviewed_at 2023_10_10; target:dest_ip;)
Aug 28, 2023, 12:00 PM
Oct 10, 2023, 12:00 PM
Aug 28, 2023, 10:00 PM
May 31, 2024, 9:00 PM
rules/emerging-hunting.rules