ET PHISHING BlackShadow Raphael Company Impersonation Form Submission

SID: 2057197Rev: 112 views
Sourceet/open
CreatedNovember 1, 2024
UpdatedNovember 1, 2024
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING BlackShadow Raphael Company Impersonation Form Submission"; flow:established,to_server; urilen:76; http.method; content:"GET"; http.uri; content:"|2f|form|3f|token|3d|"; startswith; fast_pattern; pcre:"/^[A-Z0-9]{64}$/R"; http.header_names; content:!"|0d 0a|referer|0d 0a|"; nocase; reference:url,gov.il/he/pages/alert_1817; classtype:trojan-activity; sid:2057197; rev:1; metadata:created_at 2024_11_01, confidence Medium, signature_severity Major, updated_at 2024_11_01;)

References

urlgov.il/he/pages/alert_1817

Metadata

created at2024_11_01
confidenceMedium
signature severityMajor
updated at2024_11_01

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!