ET WEB_CLIENT SofosFO/NeoSploit possible second stage landing page

7.0.35.0SID: 2015847Rev: 7Disabled1 views
Sourceet/open
Fileemerging-web_client.rules
CreatedOctober 27, 2012
UpdatedMarch 17, 2024
Classificationtrojan-activity
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT SofosFO/NeoSploit possible second stage landing page"; flow:established,to_server; flowbits:set,et.exploitkitlanding; urilen:>25; http.uri; content:"/50a"; startswith; pcre:"/^\/50a[a-f0-9]{21}\/(((\d+,)+\d+)|null)\//"; classtype:trojan-activity; sid:2015847; rev:7; metadata:created_at 2012_10_27, signature_severity Major, updated_at 2024_03_17;)

Metadata

created at2012_10_27
signature severityMajor
updated at2024_03_17

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!