alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Malicious SCF File Inbound"; flow:to_client,established; file_data; content:"[shell]"; nocase; content:"iconfile"; nocase; distance:0; pcre:"/^\s*=\s*\x5c\x5c/Rs"; reference:url,defensecode.com/news_article.php?id=21; classtype:attempted-user; sid:2024303; rev:2;)

Added 2017-05-16 19:22:01 UTC


Topic revision: r1 - 2017-05-16 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats