ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 3
Sourceet/open
CreatedSeptember 20, 2013
UpdatedApril 19, 2023
Classificationbad-unknown
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 3"; flow:established,from_server; file_data; content:"unescape"; content:"|27 5f|u"; nocase; content:!"|27|"; within:100; pcre:"/^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}/Ri"; classtype:bad-unknown; sid:2017502; rev:3; metadata:created_at 2013_09_20, deployment alert_only, signature_severity Minor, updated_at 2023_04_19;)
Metadata
created at2013_09_20
deploymentalert_only
signature severityMinor
updated at2023_04_19
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!