""ET CURRENT_EVENTS Evil Redirector Leading to EK Feb 05 2016""
SID: 2022493
Revision: 1
Class Type: trojan-activity
Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_02_06, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_02_06
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: established,to_server
Contents:
- Value: "/?keyword="
Within:
PCRE: "/\/\?keyword=(?:(?=[a-f]{0,31}[0-9])(?=[0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$/U"
Special Options:
- http_uri