ET DELETED Possible Sweet Orange Secondary Landing

SID: 2019351Rev: 30 views
History
Sourceet/open
CreatedOctober 3, 2014
UpdatedJuly 26, 2019
Classificationexploit-kit
alert tcp $HOME_NET any -> $EXTERNAL_NET 10000: (msg:"ET DELETED Possible Sweet Orange Secondary Landing"; flow:established,to_server; content:"GET "; depth:4; pcre:"/(?:\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1/R"; content:"3 HTTP/1.1"; fast_pattern:only; classtype:exploit-kit; sid:2019351; rev:3; metadata:created_at 2014_10_03, signature_severity Unknown, updated_at 2019_07_26;)

Metadata

created at2014_10_03
signature severityUnknown
updated at2019_07_26

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!