alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; reference:url,doc.emergingthreats.net/2007705; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB/WEB_Neosploit; sid:2007705; rev:5;)

Added 2009-02-16 21:46:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; reference:url,doc.emergingthreats.net/2007705; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB/WEB_Neosploit; sid:2007705; rev:5;)

Added 2009-02-16 21:46:09 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; reference:url,doc.emergingthreats.net/2007705; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB/WEB_Neosploit; sid:2007705; rev:5;)

Added 2009-02-16 21:45:24 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; reference:url,doc.emergingthreats.net/2007705; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB/WEB_Neosploit; sid:2007705; rev:5;)

Added 2009-02-16 21:45:24 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:4;)

Added 2008-11-25 09:49:36 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:4;)

Added 2008-11-25 09:49:36 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:4;)

Added 2008-11-25 09:45:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; content:"?u"; within:10; content:"_"; within:2; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:4;)

Added 2008-11-25 09:45:22 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:3;)

Added 2008-06-26 12:27:02 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:3;)

Added 2008-06-26 12:27:02 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; nocase; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:2;)

Added 2008-01-31 18:48:11 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to_server,established; content:"GET "; depth:4; nocase; pcre:"/\?u\d_\d_\d{3,4}_\d_\d_\d{10}_\d{10}_\d{9,10}[_\da-z]{0,9}$/Ui"; classtype:web-application-attack; sid:2007705; rev:2;)

Added 2008-01-31 18:48:11 UTC