ET PHISHING Possible Phishing Landing Obfuscation 2016-02-26

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Possible Phishing Landing Obfuscation 2016-02-26";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    http.content_type;
    content:"text/html";
    http.content_len;
    byte_test:0,<,8192,0,string,dec;
    file.data;
    content:"eval|28|unescape|28 27|";
    content:"%66%75%6e%63%74%69%6f%6e"; distance:0;
    content:"%7b%0a%09%76%61%72%20"; distance:0;
    content:"%0a%09%76%61%72%20%74%6d%70%20%3d%20%73%2e%73%70%6c%69%74%28%22";
    pcre:"/^(\%[0-9]{2}){8}%22/R";
    content:"%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%30%5d%29%3b%0a%09%6b%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%31%5d%20%2b%20%22"; distance:0;
    pcre:"/^(\%[0-9]{2}){6}%22%29%3b%0a%09/R";
    content:"%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%28%70%61%72%73%65%49%6e%74%28"; distance:0; fast_pattern;
    content:"eval|28|unescape|28 27|%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65"; distance:0;
    content:"unescape|28 27|%27%29%29%3b|27 29 29 3b|"; distance:0;
    reference:url,www.proofpoint.com/sites/default/files/proofpoint-obfuscation-techniques-phishing-attacks-threat-insight-en-v1.pdf;
    classtype:social-engineering;
    sid:2032372; rev:5;
    metadata:attack_target Client_Endpoint, created_at 2016_02_26, deployment Perimeter, confidence Medium, signature_severity Critical, tag Phishing, updated_at 2023_12_14, reviewed_at 2024_04_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;
)