""ET CURRENT_EVENTS Possible Phishing Landing Obfuscation 2016-02-26""

SID: 2032372

Revision: 5

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2016_02_26, deployment Perimeter, signature_severity Critical, tag Phishing, updated_at 2023_12_18, reviewed_at 2024_04_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "eval|28|unescape|28 27|"

  • Value: "%66%75%6e%63%74%69%6f%6e"

  • Value: "%7b%0a%09%76%61%72%20"

  • Value: "%0a%09%76%61%72%20%74%6d%70%20%3d%20%73%2e%73%70%6c%69%74%28%22"

  • Value: "%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%30%5d%29%3b%0a%09%6b%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%31%5d%20%2b%20%22"

  • Value: "%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%28%70%61%72%73%65%49%6e%74%28"

  • Value: "eval|28|unescape|28 27|%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65"

  • Value: "unescape|28 27|%27%29%29%3b|27 29 29 3b|"

Within:

PCRE: "/^(\%[0-9]{2}){6}%22%29%3b%0a%09/R"

Special Options:

  • http_stat_code

  • file_data

  • fast_pattern

source