ET PHISHING Generic Credential Phish Landing Page with Implicit Cloudflare Turnstile Rendering 2024-11-07

SID: 2057302Rev: 19 views
Sourceet/open
CreatedNovember 7, 2024
UpdatedNovember 7, 2024
Classificationcredential-theft
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Credential Phish Landing Page with Implicit Cloudflare Turnstile Rendering 2024-11-07"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"<head>"; content:"function redirect()"; distance:0; content:"atob"; distance:0; content:"window.location.href"; distance:0; content:"redirect()|3b|"; distance:0; content:"challenges.cloudflare.com/turnstile/v0/api.js"; distance:0; fast_pattern; content:"</head>"; distance:0; content:"<body>"; distance:0; content:"class|3d 22|cf|2d|turnstile|22 20|"; distance:0; content:"data-sitekey="; distance:0; content:"data-callback="; distance:0; content:"</body>"; distance:0; reference:url,developers.cloudflare.com/turnstile/get-started/client-side-rendering/#implicitly-render-the-turnstile-widget; classtype:credential-theft; sid:2057302; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_11_07, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Phishing, updated_at 2024_11_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)

References

urldevelopers.cloudflare.com/turnstile/get-started/client-side-rendering/#implicitly-render-the-turnstile-widget

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2024_11_07
deploymentSSLDecrypt
confidenceHigh
signature severityMajor
tagPhishing
updated at2024_11_07
mitre tactic idTA0001
mitre tactic nameInitial_Access
mitre technique idT1566
mitre technique namePhishing

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!