ET EXPLOIT_KIT Applet tag in jjencode as (as seen in Dotka Chef EK)
Sourceet/open
CreatedJune 27, 2013
UpdatedOctober 8, 2019
Classificationexploit-kit
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Applet tag in jjencode as (as seen in Dotka Chef EK)"; flow:established,from_server; file_data; content:",$$$$|3a|(![]+|22 22|)"; fast_pattern; content:"<|22|+"; pcre:"/^(?P<var>.{1,10})\.\$\_\$\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\$\$\_\+(?P=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\$\$\_\+(?P=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(?P=var)\.\_\$\_\]\+(?P=var)\.\$\$\$\_\+(?P=var)\.\_\_\+/R"; classtype:exploit-kit; sid:2017070; rev:3; metadata:created_at 2013_06_27, signature_severity Major, updated_at 2019_10_08;)
Metadata
created at2013_06_27
signature severityMajor
updated at2019_10_08
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!