ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1

7.0.35.0SID: 2017499Rev: 4Enabled3 views
Sourceet/open
Fileemerging-attack_response.rules
CreatedSeptember 20, 2013
UpdatedMarch 13, 2024
Classificationbad-unknown
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1"; flow:established,to_client; file.data; content:"unescape"; content:"|22|%u"; content:!"|22|"; within:120; pcre:"/^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}/Ri"; classtype:bad-unknown; sid:2017499; rev:4; metadata:created_at 2013_09_20, deployment alert_only, signature_severity Minor, updated_at 2024_03_13;)

Metadata

created at2013_09_20
deploymentalert_only
signature severityMinor
updated at2024_03_13

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!