ET EXPLOIT_KIT Possible HanJuan Landing March 20 2015
Sourceet/open
CreatedMarch 20, 2015
UpdatedMarch 3, 2024
Classificationexploit-kit
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible HanJuan Landing March 20 2015"; flow:established,to_client; http.server; content:"nginx"; startswith; http.content_type; content:"text/html"; startswith; file.data; content:!"<body>"; content:!"<html>"; content:"<script>"; startswith; pcre:"/^\s*[a-z]+\s*?=\s*?(?P<q1>[\x22\x27])(?:(?!(?P=q1)).)+?(?P=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*?=\s*?(?P<q2>[\x22\x27])(?:(?!(?P=q2)).)+?(?P=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr/Rs"; content:"]/g,|27 27|).substr|28|"; fast_pattern; classtype:exploit-kit; sid:2020719; rev:6; metadata:created_at 2015_03_20, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_03;)
Metadata
created at2015_03_20
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_03_03
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!