ET EXPLOIT Wscript Shell Run Attempt - Likely Hostile

Query · suricata

flow:established,to_server;
content:"WScript.Shell"; nocase;
content:".Run"; nocase; within:100;
pcre:"/[\r\n\s]+(?P<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(?P=var1)\.run/si";
Raw source ET EXPLOIT Wscript Shell Run Attempt - Likely Hostile · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET EXPLOIT Wscript Shell Run Attempt - Likely Hostile";
    flow:established,to_server;
    content:"WScript.Shell"; nocase;
    content:".Run"; nocase; within:100;
    pcre:"/[\r\n\s]+(?P<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(?P=var1)\.run/si";
    classtype:attempted-user;
    sid:2017205; rev:2;
    metadata:created_at 2013_07_27, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.