##alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Excessive JavaScript? replace /g - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; file_data; content:"replace|28 2F|"; nocase; distance:0; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; classtype:bad-unknown; sid:2014098; rev:5;)

Added 2012-04-30 18:34:25 UTC


#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive JavaScript? replace /g - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; file_data; content:"replace|28 2F|"; nocase; distance:0; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; flowbits:set,et.exploitkitlanding; flowbits:noalert; classtype:bad-unknown; sid:2014098; rev:2;)

Added 2012-01-06 09:05:48 UTC


#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive JavaScript? replace /g - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; file_data; content:"replace|28 2F|"; nocase; distance:0; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; flowbits:set,et.exploitkitlanding; flowbits:noalert; classtype:bad-unknown; sid:2014098; rev:2;)

Added 2012-01-05 19:54:11 UTC


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive JavaScript? replace /g - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; file_data; content:"replace|28 2F|"; nocase; distance:0; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; content:"replace|28 2F|"; within:80; nocase; content:"|2F|g"; distance:1; within:5; flowbits:set,et.exploitkitlanding; flowbits:noalert; classtype:bad-unknown; sid:2014098; rev:2;)

Added 2012-01-04 18:24:12 UTC


Topic revision: r1 - 2012-04-30 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats