ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)

SID: 2019094Rev: 80 views
History
Sourceet/open
CreatedAugust 30, 2014
UpdatedSeptember 17, 2020
Classificationexploit-kit
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".php"; endswith; http.request_body; content:"seed="; fast_pattern; content:"&referrer="; content:"&agent="; content:"&location="; content:"&toplocation="; reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks; classtype:exploit-kit; sid:2019094; rev:8; metadata:created_at 2014_08_30, signature_severity Major, updated_at 2020_09_17;)

References

urlwww.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks

Metadata

created at2014_08_30
signature severityMajor
updated at2020_09_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!