""ET CURRENT_EVENTS [Deepend Research] BestaBid FakeFlash Redirect""

SID: 2025374

Revision: 2

Class Type: bad-unknown

Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_21, deployment Perimeter, signature_severity Major, tag FakeFlash, updated_at 2018_02_21

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

  • Value: "302"

  • Value: "Location"

  • Value: "/?pcl="

  • Value: ".&cid="

Within:

PCRE: "/^Location\x3a\x20[^\r\n]+\/\?pcl=(?:[a-zA-Z0-9_-]{86}|[a-zA-Z0-9_-]{43})\x2e{1,2}&cid=/Hmi"

Special Options:

  • http_stat_code

  • nocase

  • http_header

  • nocase

  • http_header

  • fast_pattern

  • nocase

  • http_header

source