""ET CURRENT_EVENTS Possible CookieBomb Generic JavaScript Format""

SID: 2017373

Revision: 5

Class Type: trojan-activity

Metadata: created_at 2013_08_26, updated_at 2013_08_26

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

• Value: "/*/"

• Value: "="

• Value: !"|22|"

• Value: !"|27|"

Within: 500

PCRE: "/^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(?P[a-f0-9]{2})(?P[^\x22\x27a-f0-9]{0,10})(?P(?!(?P=f))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)|(?P=i)))[a-f0-9]{2})(?P=sep)(?P=n)(?P=sep)(?P[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){1,100}(?P=spc)/Ri"

Special Options:

• file_data

• fast_pattern

source