""ET CURRENT_EVENTS Fake Google Chrome Error Landing Page, Control Access with Cookie""

SID: 2045128

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2023_04_21, deployment Perimeter, signature_severity Major, updated_at 2023_04_21

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "function load_payload()"

  • Value: "document.createElement('iframe')|3b|"

  • Value: "filename = `chromium-patch-nightly."

  • Value: "Math.random().toString().substr("

  • Value: "fetch|28 27|"

  • Value: "|2f|release|2e|zip|27 29|"

  • Value: "e.file('payload.exe')"

  • Value: "zip|2e|remove|28 27|payload|2e|exe|27 29|"

  • Value: "iframe|2e|style|20 3d 20 27|display|3a|None|27 3b|"

Within:

PCRE:

Special Options:

  • http_stat_code

  • file_data

  • fast_pattern

source