ET PHISHING Outlook WebApp Phish Landing 2015-11-05

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Outlook WebApp Phish Landing 2015-11-05";
    flow:established,from_server;
    file_data;
    content:"var translate_dict = {"; nocase;
    content:"VERIFICATION_CODE"; nocase; distance:0; fast_pattern;
    content:"VERIFICATION_CODE_REQUIRED"; nocase; distance:0;
    content:"NOT_BEGIN_OR_END_WITH_SPACE"; nocase; distance:0;
    content:"USERNAME_ALL_NUMERIC"; nocase; distance:0;
    content:"PASSWORDS_DONT_MATCH"; nocase; distance:0;
    content:"PWD_HINT_REQUIRED"; nocase; distance:0;
    content:"PASSWORD_MATCHES_USERNAME"; nocase; distance:0;
    content:"REQUEST_PASSWORD_RESET"; nocase; distance:0;
    content:"ENTER_VALID_VERIFICATION_CODE"; nocase; distance:0;
    content:"PASSWORD_MATCH_HINT"; nocase; distance:0;
    content:"Your work here is done"; nocase; distance:0;
    content:"Yikes! Something's gone wrong."; nocase; distance:0;
    classtype:social-engineering;
    sid:2031691; rev:2;
    metadata:created_at 2015_11_05, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)