alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Manhattan College Phish Landing Page 2022-01-10"; flow:established,to_client; content:"|3c 21 2d 2d 20|saved|20|from|20|url|3d 28|0014|29|about|3a|internet|20 2d 2d 3e|"; content:"|3c|title|3e|JasperNET|20|Login|3c 2f|title|3e|"; distance:0; content:"|3c|link|20|rel|3d 22|icon|22 20|href|3d 22|https|3a 2f 2f|auth|2e|manhattan|2e|edu|2f|idp|2f|ellucian|2f|favicon|2e|ico|22 20|type|3d 22|image|2f|x|2d|icon|22 3e|"; distance:0; fast_pattern; reference:md5,fad9485f5b89cfb9ba3490ffb767a850; classtype:credential-theft; sid:2043286; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_01_11, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_11, reviewed_at 2024_12_24;)