""ET CURRENT_EVENTS Credito Emiliano Credential Phish Landing Page 2022-05-26""

SID: 2036702

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_26, deployment Perimeter, signature_severity Critical, tag Phishing, updated_at 2022_05_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing

Reference:

• md5

• ddae39f72f8e48fe26aa70dbbd8e660a

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "200"

• Value: "|3c|title|3e|Mobile|20|Banking|20 2d 20|Accesso|3c 2f|title|3e|"

• Value: "jQuery|28 27 23|scadenza|27 29 2e|payform|28 27|formatCardExpiry|27 29 3b|"

• Value: "jQuery|28 27 23|carta|27 29 2e|payform|28 27|formatCardNumber|27 29 3b|"

• Value: "method|3d 22|POST|22 20|action|3d 22|index|2e|php|22|"

• Value: "type|3d 22|password|22|"

Within:

PCRE:

Special Options:

• http_stat_code

• file_data

• fast_pattern

source