ET PHISHING Generic Credential Phish Landing Page 2023-08-09

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Generic Credential Phish Landing Page 2023-08-09";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    file.data;
    content:"|3c|html|20|value|3d 22|";
    content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0;
    content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0;
    content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0;
    content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0;
    content:"HNwYW4gY2xhc3M9Im5vcGUi"; distance:0;
    content:"|22 3e 3c|script"; distance:0;
    content:"data|3a|text|2f|javascript|3b|base64|2c|ZG9jdW1lbnQud3JpdGUoZGVjb2RlVVJJQ29tcG9uZW50KGVzY2FwZShhdG9iKGRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoImh0bWwiKS5nZXRBdHRyaWJ1dGUoInZhbHVlIikpKSkpO25veD0i"; distance:0; fast_pattern;
    reference:url,tria.ge/230809-w48wlagc61;
    reference:url,tria.ge/230809-bsqwesab6z;
    classtype:credential-theft;
    sid:2047155; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2023_08_09, deployment Perimeter, confidence High, signature_severity Major, tag Phishing, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_08_16;
)