alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Credential Phish Landing Page 2023-08-09"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"|3c|html|20|value|3d 22|"; content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0; content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0; content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0; content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0; content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0; content:"|22 3e 3c|script"; distance:0; content:"data|3a|text|2f|javascript|3b|base64|2c|ZG9jdW1lbnQud3JpdGUoZGVjb2RlVVJJQ29tcG9uZW50KGVzY2FwZShhdG9iKGRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoImh0bWwiKS5nZXRBdHRyaWJ1dGUoInZhbHVlIikpKSkpO25veD0i"; distance:0; fast_pattern; reference:url,tria.ge/230809-w48wlagc61; reference:url,tria.ge/230809-bsqwesab6z; classtype:credential-theft; sid:2047155; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_08_09, deployment Perimeter, confidence High, signature_severity Major, tag Phishing, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_08_16;)