ET EXPLOIT Exim4 UAF Attempt (BDAT with non-printable chars)

Query · suricata

flow:established,to_server;
content:"BDAT"; depth:5;
pcre:"/^\s*\d*[^\x20-\x7e\r\n\t]/R";
Raw source ET EXPLOIT Exim4 UAF Attempt (BDAT with non-printable chars) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert smtp any any -> $SMTP_SERVERS any (
    msg:"ET EXPLOIT Exim4 UAF Attempt (BDAT with non-printable chars)";
    flow:established,to_server;
    content:"BDAT"; depth:5;
    pcre:"/^\s*\d*[^\x20-\x7e\r\n\t]/R";
    reference:url,lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html;
    classtype:attempted-admin;
    sid:2025063; rev:3;
    metadata:attack_target SMTP_Server, created_at 2017_11_27, deployment Internal, deployment Datacenter, performance_impact Moderate, confidence High, signature_severity Major, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.