ET PHISHING Manhattan College Phish Landing Page 2022-01-10

Query · suricata

flow:established,to_client;
content:"|3c 21 2d 2d 20|saved|20|from|20|url|3d 28|0014|29|about|3a|internet|20 2d 2d 3e|";
content:"|3c|title|3e|JasperNET|20|Login|3c 2f|title|3e|"; distance:0;
content:"|3c|link|20|rel|3d 22|icon|22 20|href|3d 22|https|3a 2f 2f|auth|2e|manhattan|2e|edu|2f|idp|2f|ellucian|2f|favicon|2e|ico|22 20|type|3d 22|image|2f|x|2d|icon|22 3e|"; distance:0; fast_pattern;
Raw source ET PHISHING Manhattan College Phish Landing Page 2022-01-10 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Manhattan College Phish Landing Page 2022-01-10";
    flow:established,to_client;
    content:"|3c 21 2d 2d 20|saved|20|from|20|url|3d 28|0014|29|about|3a|internet|20 2d 2d 3e|";
    content:"|3c|title|3e|JasperNET|20|Login|3c 2f|title|3e|"; distance:0;
    content:"|3c|link|20|rel|3d 22|icon|22 20|href|3d 22|https|3a 2f 2f|auth|2e|manhattan|2e|edu|2f|idp|2f|ellucian|2f|favicon|2e|ico|22 20|type|3d 22|image|2f|x|2d|icon|22 3e|"; distance:0; fast_pattern;
    reference:md5,fad9485f5b89cfb9ba3490ffb767a850;
    classtype:credential-theft;
    sid:2043286; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2023_01_11, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_01_11, reviewed_at 2024_12_24;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.