ET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct
Sourceet/open
CreatedOctober 28, 2014
UpdatedFebruary 23, 2024
Classificationexploit-kit
alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct"; flow:established,to_server; http.uri; pcre:"/\/(?=[a-z0-9]{0,10}[A-Z])(?=[A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,11}$/"; http.header; content:"x-flash-version|3a|"; fast_pattern; pcre:"/^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+?=\d/m"; classtype:exploit-kit; sid:2019543; rev:3; metadata:created_at 2014_10_28, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)
Metadata
created at2014_10_28
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_02_23
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!