#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (
# msg:"ET DELETED Blackhole Exploit Kit Java Rhino Script Engine Remote Code Execution Attempt";
# flow:established,to_client;
# content:"document.createElement('applet'"; nocase;
# content:"setAttribute('code"; nocase; distance:0;
# content:"setAttribute('archive"; nocase; distance:0;
# content:".jar"; nocase; distance:0;
# content:"document.createElement('param"; nocase; distance:0;
# content:"setAttribute('name"; nocase; distance:0;
# content:"setAttribute('value"; nocase; distance:0;
# reference:url,blog.eset.com/2011/12/15/spam-campaign-uses-blackhole-exploit-kit-to-install-spyeye;
# reference:bid,50218;
# reference:cve,2011-3544;
# classtype:exploit-kit;
# sid:2014048; rev:8;
# metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2021_06_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
#)