ET POLICY ASProtect/ASPack Packed Binary

Query · suricata

flow:from_server,established;
flowbits:isnotset,ET.http.binary;
content:"|2E 61 73 70 61 63 6B|";
file_data;
content:"MZ"; within:2;
byte_jump:4,58,relative,little;
content:"PE|00 00|"; distance:-64; within:4;
flowbits:set,ET.http.binary;

Rule dependencies

Excludes

  • ET.http.binary — excluded, not a dependency

Feeds into

  • 28 rules read ET.http.binary · view all
Raw source ET POLICY ASProtect/ASPack Packed Binary · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
#alert http $EXTERNAL_NET any -> $HOME_NET any (
#    msg:"ET POLICY ASProtect/ASPack Packed Binary";
#    flow:from_server,established;
#    flowbits:isnotset,ET.http.binary;
#    content:"|2E 61 73 70 61 63 6B|";
#    file_data;
#    content:"MZ"; within:2;
#    byte_jump:4,58,relative,little;
#    content:"PE|00 00|"; distance:-64; within:4;
#    flowbits:set,ET.http.binary;
#    reference:url,www.aspack.com/downloads.aspx;
#    reference:url,bits.packetninjas.org/eblog;
#    classtype:misc-activity;
#    sid:2008575; rev:6;
#    metadata:created_at 2010_07_30, deployment Perimeter, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_08;
#)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.