""ET CURRENT_EVENTS Sparkasse Credential Phish Landing Page M2 2022-04-13""

SID: 2035936

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_13, deployment Perimeter, signature_severity Major, updated_at 2022_04_13

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "Code?sslchannel=true&sessionid="

  • Value: "type=|22|password|22|"

  • Value: "window.screen.availWidth"

  • Value: "window.screen.availHeight"

  • Value: "jscd.browser"

  • Value: "jscd.browserMajorVersion"

  • Value: "jscd.browserVersion"

  • Value: "jscd.os"

  • Value: "jscd.osVersion"

  • Value: "jscd.screen"

  • Value: "avail_res"

  • Value: "screen.colorDepth"

  • Value: "screen.deviceXDPI"

  • Value: "screen.deviceYDPI"

  • Value: "language"

  • Value: "jscd|2e|flashVersion|3b|"

  • Value: "navigator.javaEnabled()"

  • Value: "mime"

  • Value: "plugins"

  • Value: "listFonts().join(',')"

Within: 45

PCRE:

Special Options:

  • http_stat_code

  • file_data

  • fast_pattern

source