ET EXPLOIT_KIT Possible Router EK Landing Page Inbound 2019-05-24

Query · suricata

flow:established,from_server;
http.stat_code;
content:"200";
file.data;
content:">Loading ...<|2f|title>";
content:"|3b|base64,"; distance:0;
content:"ZnVuY3Rpb24gTWFrZShDcmVkZW50aWF"; distance:0; fast_pattern;
content:"ZG5zU2Vjb25kYXJ5OiAn"; distance:0;
Raw source ET EXPLOIT_KIT Possible Router EK Landing Page Inbound 2019-05-24 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT_KIT Possible Router EK Landing Page Inbound 2019-05-24";
    flow:established,from_server;
    http.stat_code;
    content:"200";
    file.data;
    content:">Loading ...<|2f|title>";
    content:"|3b|base64,"; distance:0;
    content:"ZnVuY3Rpb24gTWFrZShDcmVkZW50aWF"; distance:0; fast_pattern;
    content:"ZG5zU2Vjb25kYXJ5OiAn"; distance:0;
    classtype:exploit-kit;
    sid:2027380; rev:3;
    metadata:created_at 2019_05_24, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_11_04;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.