ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07

SID: 2057301Rev: 19 views
Sourceet/open
CreatedNovember 7, 2024
UpdatedNovember 7, 2024
Classificationcredential-theft
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"<head>"; content:"challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"; distance:0; content:"sendRequest()"; distance:0; content:"String.fromCharCode"; distance:0; content:"function sendRequest()"; distance:0; content:"xhr|2e|setRequestHeader|28 22|qrc|2d|auth|22|"; distance:0; fast_pattern; content:"</head>"; distance:0; reference:url,developers.cloudflare.com/turnstile/get-started/client-side-rendering/#explicitly-render-the-turnstile-widget; classtype:credential-theft; sid:2057301; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_11_07, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Phishing, updated_at 2024_11_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)

References

urldevelopers.cloudflare.com/turnstile/get-started/client-side-rendering/#explicitly-render-the-turnstile-widget

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2024_11_07
deploymentSSLDecrypt
confidenceHigh
signature severityMajor
tagPhishing
updated at2024_11_07
mitre tactic idTA0001
mitre tactic nameInitial_Access
mitre technique idT1566
mitre technique namePhishing

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!