Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING JavaScript Engine JIT Forcing Observed - Investigate Possible Exploitation M6"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"for"; content:"|28|let"; fast_pattern; within:5; pcre:"/^\s*?(?P<counter>[\w\-]{1,20})\s*=\s*\d+\s*?\x3b\s*?(?P=counter)\s*?<\s*?\d{4,}\s*?\x3b\s*?(?P=counter)\+\+\s*?\)\s*?\{\s*?(?P<arr>[\w\-]){1,20}\x5b(?P=counter)\x5d\s*?=\s*?(?P=counter)\s*?\+.{0,200}\x7d/Rsi"; classtype:unknown; sid:2058057; rev:1; metadata:created_at 2024_11_23, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_04, former_sid 2859130;)