""ET WEB_CLIENT Oracle Java 6 Object Tag launchjnlp docbase Parameters Flowbits Set""
SID: 2012085
Revision: 2
Class Type: not-suspicious
Metadata: affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_12_22, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2010_12_23
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: to_client,established
Contents:
-
Value: "NtDllImageBase|22|"
-
Value: "getModuleInfos|28|"
-
Value: "|27|ntdll.dll|27|"
Within: 50
PCRE:
Special Options:
-
nocase
-
nocase