ET PHISHING Possible Successful Phish - Generic Status Messages Sept 11 2015

alert http $EXTERNAL_NET !2095 -> $HOME_NET any (
    msg:"ET PHISHING Possible Successful Phish - Generic Status Messages Sept 11 2015";
    flow:established,to_client;
    file_data;
    content:"|22|ajax_timeout|22 20 3A 20 22|";
    content:"Authenticating|20 E2 80 A6 22 2C|"; fast_pattern; distance:0;
    content:"|22|expired_session|22 20 3A 20 22|Your"; distance:0;
    content:"|22|prevented_xfer|22 20 3A 20 22|The session"; distance:0;
    content:"successful. Redirecting|20 E2 80 A6 22 2C|"; distance:0;
    content:"|22|token_incorrect|22 20 3A 20 22|The security"; distance:0;
    classtype:credential-theft;
    sid:2021761; rev:5;
    metadata:attack_target Client_Endpoint, created_at 2015_09_11, deployment Perimeter, confidence Medium, signature_severity Critical, tag Phishing, updated_at 2019_07_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;
)