""ET CURRENT_EVENTS Possible PDF Dictionary Entry with Hex/Ascii replacement""
SID: 2017899
Revision: 3
Class Type: trojan-activity
Metadata: created_at 2013_12_24, updated_at 2013_12_30
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "%PDF-"
-
Value: "obj"
Within: 5
PCRE: "/^[\r\n\s]?<<(?:(?!>>).)+?\/[a-zA-Z\d]?#(?:[46][1-9a-fA-F]|[57][\daA])(?:[a-zA-Z\d])*?#(?:[46][1-9a-fA-F]|[57][\daA])/Rsi"
Special Options:
-
file_data
-
fast_pattern