r1 - 28 Nov 2007 - 23:31:07 - TWikiGuestYou are here: TWiki >  Main Web > 2003174

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT Possible UTF-16 encoded Shellcode Detected";flow:from_server,established;pcre:"/(%U([0-9a-f]{4})){6}/i";classtype:trojan-activity;sid:2003174; rev:3;)

Added 2007-11-28 23:31:07 UTC

 


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT Possible UTF-16 encoded Shellcode Detected";flow:from_server,established;pcre:"/(%U([0-9a-f]{4})){6}/i";classtype:trojan-activity;sid:2003174; rev:3;)

Added 2007-11-28 23:31:07 UTC


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT Possible UTF-16 encoded Shellcode Detected";flow:from_server,established;pcre:"/(%U([0-9a-f]{4})){2}/i";classtype:trojan-activity;sid:2003174; rev:2;)

Added 2007-03-19 13:15:20 UTC


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT Possible UTF-16 encoded Shellcode Detected";flow:from_server,established;pcre:"/(%[uU]([0-9A-Fa-f]{4})){2}/";classtype:trojan-activity;sid:2003174; rev:1;)



Edit | Attach | Printable | Raw View | Backlinks: Web, All Webs | History: r1 | More topic actions

 
Docs at Bleeding Threats
This site is powered by the TWiki collaboration platformCopyright © Bleeding Edge Threats.
Ideas, requests, problems regarding TWiki? Send feedback