ET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct

7.0.35.0SID: 2019543Rev: 5Disabled2 views
Sourceet/open
Fileemerging-exploit_kit.rules
CreatedOctober 28, 2014
UpdatedApril 19, 2024
Classificationexploit-kit
alert http1 $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Likely SweetOrange EK Flash Exploit URI Struct"; flow:established,to_server; http.uri; pcre:"/\/(?=[a-z0-9]{0,10}[A-Z])(?=[A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,11}$/"; http.referer; pcre:"/^[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+?=\d/m"; http.header_names; content:"|0d 0a|x-flash-version|0d 0a|"; fast_pattern; classtype:exploit-kit; sid:2019543; rev:5; metadata:created_at 2014_10_28, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_19;)

Metadata

created at2014_10_28
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2024_04_19

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!