ET EXPLOIT_KIT Likely CottonCastle/Niteris EK Response June 19 2015
Sourceet/open
CreatedJune 19, 2015
UpdatedFebruary 23, 2024
Classificationexploit-kit
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely CottonCastle/Niteris EK Response June 19 2015"; flow:established,to_client; http.header; content:"Refresh|3a 20|"; content:"|3b 20|url"; distance:0; content:"/999/00000/|0d 0a|"; distance:0; fast_pattern; pcre:"/^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/m"; classtype:exploit-kit; sid:2021306; rev:3; metadata:created_at 2015_06_19, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)
Metadata
created at2015_06_19
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_02_23
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!