Rule History

SID: 2053697 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Jun 17, 2024, 12:00 PM

Message:

ET EXPLOIT_KIT Parrot TDS Check 2024-06-17

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Parrot TDS Check 2024-06-17"; flow:established,to_client; content:"|3d 21 21 5b 5d 2c|HttpClient|3d|function|28 29|"; fast_pattern; content:"|3d|new|20|XMLHttpRequest|28 29 3b|"; within:512; reference:url,unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/; classtype:exploit-kit; sid:2053697; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_06_17, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag TDS, tag Parrot_TDS, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_17;)

Created:

Jun 17, 2024, 12:00 PM

Updated:

Jun 17, 2024, 12:00 PM

DB Created:

Jun 17, 2024, 9:01 PM

DB Updated:

Aug 11, 2025, 10:35 PM

Filename:

rules/emerging-exploit_kit.rules