ET PHISHING JS Obfuscation - Possible Phishing 2016-03-01

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING JS Obfuscation - Possible Phishing 2016-03-01";
    flow:from_server,established;
    http.stat_code;
    content:"200";
    http.content_type;
    content:"text/html"; startswith;
    file.data;
    content:"%75%6E%65%73%63%61%70%65%3D%66%75%6E%63%74%69%6F%6E"; fast_pattern;
    content:"%72%65%70%6C%61%63%65%28%6E%65%77%20%52%65%67%45%78%70%28%22%25%32%36%22%2C%20%22%67%22%29%2C%20%22%26%22%29%3B"; distance:0;
    content:"%72%65%70%6C%61%63%65%28%6E%65%77%20%52%65%67%45%78%70%28%22%25%33%42%22%2C%20%22%67%22%29%2C%20%22%3B%22%29%3B"; distance:0;
    content:"%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65"; distance:0;
    content:"%72%65%70%6C%61%63%65%28%27%3C%21%2D%2D%3F%2D%2D%3E%3C%3F%27%2C%27%3C%21%2D%2D%3F%2D%2D%3E%27%29%29%3B"; distance:0;
    reference:url,proofpoint.com/us/threat-insight/post/Obfuscation-Techniques-In-Phishing-Attacks;
    classtype:social-engineering;
    sid:2022578; rev:5;
    metadata:attack_target Client_Endpoint, created_at 2016_03_01, deployment Perimeter, confidence Medium, signature_severity Critical, tag Phishing, updated_at 2020_08_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;
)