""ET WEB_CLIENT Possible Microsoft Internet Explorer URI Validation Remote Code Execution Attempt""

SID: 2010798

Revision: 3

Class Type: attempted-user

Metadata: affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2010_07_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

  • cve

  • 2010-0027

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "#|3A|../../"

  • Value: "C|3A 5C|"

Within: 50

PCRE: "/\x2E\x2E\x2F\x2E\x2E\x2F.+C\x3A\x5C[a-z]/si"

Special Options:

  • nocase

source