""ET CURRENT_EVENTS Suspicious Wordpress Redirect - Possible Phishing Landing Jan 7 2016""

SID: 2025671

Revision: 4

Class Type: trojan-activity

Metadata: affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Client_Endpoint, created_at 2016_01_08, deployment Perimeter, deployment Datacenter, performance_impact Significant, signature_severity Critical, tag Phishing, tag Wordpress, updated_at 2024_04_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: to_client,established

Contents:

• Value: "302"

• Value: "|0d 0a|Content-Length|3a 20|0|0d 0a|"

• Value: "|0d 0a|location|3a 20|"

Within:

PCRE: "/^[a-f0-9]{32}(?:\/index.php)?\x0d\x0a/R"

Special Options:

• http_stat_code

• http_header

• fast_pattern

• nocase

source