ET PHISHING Base64 HTTP URL Refresh - Common Phish Landing Obfuscation 2016-01-01 - Suricata Rule 2031695 (et/open)

ET PHISHING Base64 HTTP URL Refresh - Common Phish Landing Obfuscation 2016-01-01

7.0.3 5.0SID: 2031695Rev: 4Enabled1 views

Fileemerging-phishing.rules

CreatedJanuary 1, 2016

UpdatedMarch 14, 2024

Classificationsocial-engineering

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Base64 HTTP URL Refresh - Common Phish Landing Obfuscation 2016-01-01"; flow:established,to_client; file.data; content:"<meta http-equiv="; nocase; content:"refresh"; distance:1; nocase; content:"data|3a|text/html|3b|base64,"; distance:0; fast_pattern; nocase; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22|\x27/Rsi"; content:!"cGFnZV9ub3RfZm91bmQuaHRtb"; classtype:social-engineering; sid:2031695; rev:4; metadata:created_at 2016_01_01, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)

Metadata

created at2016_01_01

confidenceMedium

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2024_03_14

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!