ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)

7.0.35.0SID: 2019094Rev: 9Enabled1 views
Sourceet/open
Fileemerging-exploit_kit.rules
CreatedAugust 30, 2014
UpdatedMarch 6, 2024
Classificationexploit-kit
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT ScanBox Framework used in WateringHole Attacks Initial (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.request_body; content:"seed="; fast_pattern; content:"&referrer="; content:"&agent="; content:"&location="; content:"&toplocation="; reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks; classtype:exploit-kit; sid:2019094; rev:9; metadata:created_at 2014_08_30, signature_severity Major, updated_at 2024_03_06;)

References

urlwww.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks

Metadata

created at2014_08_30
signature severityMajor
updated at2024_03_06

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!