""ET ATTACK_RESPONSE MalDoc/Generik.ILNMZZB Payload Inbound""

SID: 2038959

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_09_23, deployment Perimeter, signature_severity Major, updated_at 2022_09_23

Reference:

• Link

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "|3c|title|3e 0a|Exploit|0a 3c 2f|title|3e|" Depth: 40 Offset: 30

• Value: "|3c|script|3e 0a 2f 2f|"

• Value: "window|2e|location|2e|href|20 3d 20 22|ms|2d|msdt|3a|"

Within:

PCRE:

Special Options:

• nocase

source