alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Successful Generic Phish 2016-05-26"; flow:established,to_client; flowbits:isset,ET.genericphish; http.stat_code; content:"302"; http.header; content:"Location|3a 20|http"; nocase; fast_pattern; pcre:"/^(?:s)?\x3a\/\/[^\/]*(?:(?:t(?:dcanadatrust|escobank|radekey)|r(?:ealtyexecutive|bcd)s|x(?:finity|oom)|ourtime)\.com|a(?:s(?:perasoft\.com|b\.co\.nz)|(?:ccesbankplc|nz)\.com|mazon\.co\.uk|ruba\.it)|m(?:(?:icrosoftstore|organstanley|sn)\.com|a(?:de-in-china\.com|il\.ru))|s(?:(?:eniorpeoplemeet|cotiabank)\.com|antander\.co\.uk|uddenlink\.net)|c(?:o(?:(?:ldwellbankerpreviews|x)\.com|mpresso\.co\.th)|fapubs\.org)|w(?:e(?:althmanagement\.com|bmail\.sfr\.fr)|ww-01\.ibm\.com)|l(?:(?:endingtree|loydsbank)\.com|abanquepostale\.mobi)|v(?:(?:aluewalk|ideotron)\.com|erifyemailaddress\.org)|n(?:a(?:tionwide\.co\.uk|vyfederal\.org)|etsuite\.com)|b(?:a(?:nquepopulaire\.fr|9hus\.in)|iztree\.com)|i(?:nternetbanking\.caixa\.gov\.br|cloud\.com)|d(?:iscoverbank\.com|hl\.co\.uk)|k(?:iwibank\.co\.nz|eybank\.com)|fidelitybank\.ng|paypal\.fr|ebay\.it)\/?/Ri"; http.content_type; content:"text/html"; depth:9; classtype:credential-theft; sid:2032681; rev:9; metadata:attack_target Client_Endpoint, created_at 2016_05_26, deployment Perimeter, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Critical, tag Phishing, updated_at 2024_04_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)