""ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2""
SID: 2049925
Revision: 1
Class Type: trojan-activity
Metadata: attack_target Client_Endpoint, created_at 2024_01_05, deployment Perimeter, confidence High, signature_severity Critical, tag Exploit, updated_at 2024_01_05
Reference:
-
cve
-
2023-51765
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "From|3a 20|smuggled|40|"
-
Value: "To|3a 20|"
-
Value: "Subject|3a 20|SMUGGLED|20|EMAIL"
-
Value: "Date|3a 20|"
-
Value: "Message|2d|ID|3a 20|"
-
Value: "SMUGGLING WORKS with"
-
Value: "as|20 22|fake|22 20|end|2d|of|2d|data|20|sequence|21|"
Within:
PCRE:
Special Options:
-
nocase
-
nocase
-
nocase
-
nocase
-
nocase
-
nocase
-
nocase
-
fast_pattern