""ET EXPLOIT Inbound Smuggling Message from SMTP Smuggling Tool M2""

SID: 2049925

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2024_01_05, deployment Perimeter, confidence High, signature_severity Critical, tag Exploit, updated_at 2024_01_05

Reference:

  • cve

  • 2023-51765

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "From|3a 20|smuggled|40|"

  • Value: "To|3a 20|"

  • Value: "Subject|3a 20|SMUGGLED|20|EMAIL"

  • Value: "Date|3a 20|"

  • Value: "Message|2d|ID|3a 20|"

  • Value: "SMUGGLING WORKS with"

  • Value: "as|20 22|fake|22 20|end|2d|of|2d|data|20|sequence|21|"

Within:

PCRE:

Special Options:

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • fast_pattern

source