ET WEB_CLIENT Possible PDF Launch Function Remote Code Execution Attempt with Name Representation Obfuscation

Query · suricata

flow:to_client,established;
content:"|0d 0a 0d 0a|PDF-";
content:"/"; distance:0;
content:!"Launch"; within:6;
content:"#"; within:16;
content:".exe"; nocase; distance:0;
pcre:"/\x2F(?!Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe/sm";
Raw source ET WEB_CLIENT Possible PDF Launch Function Remote Code Execution Attempt with Name Representation Obfuscation · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET WEB_CLIENT Possible PDF Launch Function Remote Code Execution Attempt with Name Representation Obfuscation";
    flow:to_client,established;
    content:"|0d 0a 0d 0a|PDF-";
    content:"/"; distance:0;
    content:!"Launch"; within:6;
    content:"#"; within:16;
    content:".exe"; nocase; distance:0;
    pcre:"/\x2F(?!Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe/sm";
    reference:url,www.kb.cert.org/vuls/id/570177;
    reference:url,www.h-online.com/security/news/item/Criminals-attempt-to-exploit-unpatched-hole-in-Adobe-Reader-979286.html;
    reference:url,www.sudosecure.net/archives/673;
    reference:url,www.h-online.com/security/news/item/Adobe-issues-official-workaround-for-PDF-vulnerability-971932.html;
    reference:url,blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/;
    reference:url,www.m86security.com/labs/i/PDF-Launch-Feature-Used-to-Install-Zeus,trace.1301~.asp;
    reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/;
    classtype:bad-unknown;
    sid:2011329; rev:5;
    metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.