""ET CURRENT_EVENTS Possible Underminer EK Landing""

SID: 2025916

Revision: 5

Class Type: trojan-activity

Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, performance_impact Significant, signature_severity Major, tag Underminer_EK, updated_at 2024_04_22

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "Content-Encoding|3a 20|gzip|0d 0a|"

  • Value: "X-UA-Compatible|3a 20|IE=9|3b 20|IE=8|3b 20|IE=7|0d 0a|"

  • Value: "style=|22|width|3a|1px|3b|height|3a|1px|22|"

  • Value: "position|3a 20|absolute|3b 20|left|3a 20|-"

  • Value: "px|3b 20|width|3a 20|1px|3b 20|height|3a 20|1px|3b 22|"

  • Value: "<!--[if lte IE 6]>"

  • Value: "if(!!window.ActiveXObject && typeof("

  • Value: "<!--[if gte IE 7]>"

  • Value: "if(!!window.ActiveXObject && typeof("

  • Value: "src="

Within: 40

PCRE: "/^\s[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}.js[\x22\x27]\s>\s<\/script>\s<\/body>/Rs"

Special Options:

  • http_stat_code

  • http_header

  • http_header

  • file_data

  • nocase

  • nocase

  • nocase

  • fast_pattern

  • nocase

  • nocase

  • nocase

  • /Rsi"

  • nocase

source