""ET WEB_CLIENT Generic HeapSpray Construct""
SID: 2018299
Revision: 2
Class Type: trojan-activity
Metadata: affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_03_20, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2014_03_20
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "createElement(|22|div|22|)"
-
Value: "for("
Within:
PCRE: "/^\s?(?P[^\x3d\x3b)\s]+)\s?=\s?0\s?\x3b(?P=var)\s?\<\s?(?:0x)?\d{3,4}\s?\x3b\s?(?P=var)++\s?)\s?\x7b[^\x7d]+?[\s?(?P=var)\s?]\s?=\s?document.createElement([\x22]div[\x22])[^\x7d]+?[\s?(?P=var)\s?]/Rsi"
Special Options:
- file_data