""ET EXPLOIT Possible Microsoft Edge Chakra.dll Type Confusion (CVE-2016-7200 CVE-2016-7201) Observed in SunDown EK 2""
SID: 2023701
Revision: 1
Class Type: attempted-user
Metadata: affected_product Microsoft_Edge_Browser, attack_target Client_Endpoint, created_at 2017_01_06, cve CVE_2016_7200, deployment Perimeter, signature_severity Critical, tag Exploit_Kit_Sundown, updated_at 2017_01_06
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "rop.length"
-
Value: "Write64"
Within:
PCRE: "/^\s\x28\sretPtrAddr.add\s\x28\si\s*\s8\s\x29\s,\srop\s\x5b/Rsi"
Special Options:
-
file_data
-
fast_pattern
-
nocase
-
nocase