alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS SocEng? Fake Font Download Template Nov 14 2017"; flow:established,from_server; file_data; content:"|63 6c 69 63 6b 5f 75 70 64|"; nocase; content:"|46 6f 6e 74 20 50 61 63 6b|"; nocase; content:"|2e 6a 73 20 66 69 6c 65 20 74 6f 20 73 74 61 72 74 20 74 68 65 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 70 72 6f 63 65 73 73 2e|"; nocase; metadata: former_category CURRENT_EVENTS; reference:url,malware-traffic-analysis.net/2017/11/12/index.html; classtype:trojan-activity; sid:2024985; rev:2; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_11_14, malware_family SocEng?, performance_impact Low, updated_at 2017_11_14;)

Added 2017-11-14 16:32:39 UTC


Topic revision: r1 - 2017-11-14 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats