ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode

Query · suricata

content:"|60 c7 02 90 67 b9 09 8b 45 f8 8b 40 5c 8b 40 04 8b 40 08 8b 40 04 8b 00 85 c0 74 3b 50 8b 40 08 8b 40 04 8d 98 d8 00 00 00 58 81 3b d0 d4 00 e1 75 e4 83 7b 04 31 74 de 89 d8 2d 00 01 00 00 c7 40 04 03 01 00 00 c7 40 0c d0 00 00 00 c7 80 f8|";
Raw source ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert udp $EXTERNAL_NET any -> $HOME_NET 500 (
    msg:"ET EXPLOIT CVE-2016-1287 Public Exploit ShellCode";
    content:"|60 c7 02 90 67 b9 09 8b 45 f8 8b 40 5c 8b 40 04 8b 40 08 8b 40 04 8b 00 85 c0 74 3b 50 8b 40 08 8b 40 04 8d 98 d8 00 00 00 58 81 3b d0 d4 00 e1 75 e4 83 7b 04 31 74 de 89 d8 2d 00 01 00 00 c7 40 04 03 01 00 00 c7 40 0c d0 00 00 00 c7 80 f8|";
    reference:url,github.com/exodusintel/disclosures/blob/master/CVE_2016_1287_PoC;
    classtype:attempted-admin;
    sid:2022820; rev:1;
    metadata:created_at 2016_05_18, cve CVE_2016_1287, confidence High, signature_severity Major, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.