ET SMTP EXE - ZIP file with .pif filename inside
Sourceet/open
CreatedFebruary 15, 2014
UpdatedJuly 26, 2019
Classificationbad-unknown
alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SMTP EXE - ZIP file with .pif filename inside"; flow:established; content:"|0D 0A 0D 0A|UmFyI"; pcre:"/^[A-Za-z0-9\/\+\x0D\x0A]+?(LnBpZ|5waW|ucGlm)/R"; classtype:bad-unknown; sid:2018144; rev:2; metadata:created_at 2014_02_15, signature_severity Informational, updated_at 2019_07_26;)
Metadata
created at2014_02_15
signature severityInformational
updated at2019_07_26
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!