""ET CURRENT_EVENTS Generic HeapSpray Construct""
SID: 2018146
Revision: 3
Class Type: bad-unknown
Metadata: created_at 2014_02_15, updated_at 2016_03_07
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "<script"
-
Value: "CollectGarbage"
-
Value: "while"
-
Value: "getElementsByClassName"
-
Value: "CollectGarbage"
Within:
PCRE: "/^\s?([^)]?(?P[^.]+)\s?.\s?length\s<\s(?:0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+)\s?{\s?(?P=var)\s?=\s?(?P=var)\s?+\s?(?P=var)\s*?}/Rsi"
Special Options:
-
file_data
-
nocase
-
fast_pattern