Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING JavaScript Engine JIT Forcing Observed - Investigate Possible Exploitation M10"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"for|20 28|let"; fast_pattern; pcre:"/^\s*?(?P<counter>[\w\-]{1,20})\s*=\s*\d+\s*?\x3b\s*?(?P=counter)\s*?<\s*?\d{4,}\s*?\x3b\s*?(?P=counter)\+\+\s*?\)\s*?\{\s*?new\s*?[\w\-]+\(\)\s*?\x3b/Ri"; classtype:unknown; sid:2058056; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_10_28, deployment Perimeter, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_10_28, former_sid 2858827; target:dest_ip;)