ET EXPLOIT_KIT Obfuscated http 2 digit sep in applet (Seen in HiMan EK)

SID: 2017551Rev: 226 viewsHistory

Sourceet/open

CreatedOctober 2, 2013

UpdatedJuly 26, 2019

Classificationexploit-kit

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Obfuscated http 2 digit sep in applet (Seen in HiMan EK)"; flow:established,from_server; file_data; content:"<applet"; content:"value"; distance:0; pcre:"/^[\r\n\s]*?=[\r\n\s]*?[\x22\x27]h(?P<sep>\d{2})t(?P=sep)t(?P=sep)p(?P=sep)\x3a/R"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2017551; rev:2; metadata:created_at 2013_10_02, signature_severity Major, updated_at 2019_07_26, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1027, mitre_technique_name Obfuscated_Files_or_Information;)

Metadata

created at2013_10_02

signature severityMajor

updated at2019_07_26

mitre tactic idTA0005

mitre tactic nameDefense_Evasion

mitre technique idT1027

mitre technique nameObfuscated_Files_or_Information

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!