ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M2

Query · suricata

flow:established,to_client;
file_data;
content:"Content-Type|3a 20|"; nocase;
content:"name"; nocase;
isdataat:78,relative;
pcre:"/^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}/R";
content:"|57 44 56 50 49 56 41 6c 51 45 46 51 57 7a 52 63 55 46 70 59 4e 54 51 6f 55 46 34 70 4e 30 4e 44 4b 54 64 39 4a 45 56 4a 51 30 46 53|";
Raw source ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M2 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible Symantec Malicious MIME Doc Name Overflow (EICAR) toclient M2";
    flow:established,to_client;
    file_data;
    content:"Content-Type|3a 20|"; nocase;
    content:"name"; nocase;
    isdataat:78,relative;
    pcre:"/^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}/R";
    content:"|57 44 56 50 49 56 41 6c 51 45 46 51 57 7a 52 63 55 46 70 59 4e 54 51 6f 55 46 34 70 4e 30 4e 44 4b 54 64 39 4a 45 56 4a 51 30 46 53|";
    reference:url,bugs.chromium.org/p/project-zero/issues/detail?id=823&q=;
    classtype:attempted-admin;
    sid:2022932; rev:2;
    metadata:created_at 2016_06_30, confidence Medium, signature_severity Major, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.