""ET CURRENT_EVENTS EITest SocEng Inject Jan 15 2017 M2""

SID: 2023744

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2017_01_17, deployment Perimeter, malware_family EITest, signature_severity Major, updated_at 2017_01_17

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

  • Value: "|69 6e 66 6f 6c|"

  • Value: "|77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65|"

  • Value: "<input"

  • Value: "<form"

Within:

PCRE: "/^(?=[^>]+action\s=\s[\x22\x27]http\x3a\x2f)[^>]+method\s=\s[\x22\x27]post[\x22\x27]/Rsi"

Special Options:

  • file_data

  • nocase

  • nocase

  • nocase

source