""ET CURRENT_EVENTS UK GOV Identity Verification Phishing Landing""
SID: 2029702
Revision: 2
Class Type: trojan-activity
Metadata: affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, signature_severity Minor, tag Phishing, updated_at 2020_03_23
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "|3c 74 69 74 6c 65 3e 50 72 d0 be ce bd d0 b5 20 ce a5 d0 be cf 85 72 20 c6 96 64 d0 b5 6e 74 69 74 79|"
-
Value: "<form action=need.php"
-
Value: "method=post"
Within:
PCRE:
Special Options:
- file_data