#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Arguments.callee.toString Javascript Obfuscation - Likely Hostile"; flow:established,to_client; content:"arguments.callee.toString"; nocase; classtype:bad-unknown; reference:url,isc.sans.edu/diary.html?storyid=3219; reference:url,malzilla.sourceforge.net/tutorial02/index.html; reference:url,isc.sans.edu/diary.html?storyid=1519; reference:url,developer.mozilla.org/En/Core_JavaScript_1.5_Reference/Functions_and_function_scope/arguments/callee; reference:url,doc.emergingthreats.net/2011762; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Java; sid:2011762; rev:2;)

Added 2010-09-25 09:11:58 UTC


#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Arguments.callee.toString Javascript Obfuscation - Likely Hostile"; flow:established,to_client; content:"arguments.callee.toString"; nocase; classtype:bad-unknown; reference:url,isc.sans.edu/diary.html?storyid=3219; reference:url,malzilla.sourceforge.net/tutorial02/index.html; reference:url,isc.sans.edu/diary.html?storyid=1519; reference:url,developer.mozilla.org/En/Core_JavaScript_1.5_Reference/Functions_and_function_scope/arguments/callee; reference:url,doc.emergingthreats.net/2011762; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Java; sid:2011762; rev:2;)

Added 2010-09-25 09:11:58 UTC


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Arguments.callee.toString Javascript Obfuscation - Likely Hostile"; flow:established,to_client; content:"arguments.callee.toString"; nocase; classtype:bad-unknown; reference:url,isc.sans.edu/diary.html?storyid=3219; reference:url,malzilla.sourceforge.net/tutorial02/index.html; reference:url,isc.sans.edu/diary.html?storyid=1519; reference:url,developer.mozilla.org/En/Core_JavaScript_1.5_Reference/Functions_and_function_scope/arguments/callee; reference:url,doc.emergingthreats.net/2011762; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Java; sid:2011762; rev:2;)

Added 2010-07-14 03:12:09 UTC


Topic revision: r1 - 2010-09-25 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats