-
Notifications
You must be signed in to change notification settings - Fork 2
/
EK Snort Rules
74 lines (53 loc) · 2.36 KB
/
EK Snort Rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
BegOP
ET CURRENT_EVENTS BegOp Exploit Kit Payload
ET CURRENT_EVENTS BegOpEK - TDS - icon.php
DotkaChef
ET CURRENT_EVENTS Redirect to DotkaChef EK Landing
SilverLight
ET CURRENT_EVENTS Angler EK SilverLight Payload Request - May 2014
g01pack
ET CURRENT_EVENTS g01pack Exploit Kit .homelinux. Landing Page
Styx
ET CURRENT_EVENTS Styx Exploit Kit - HTML
Pamdql
ET CURRENT_EVENTS PDF /FlateDecode and PDF version 1.1 (seen in pamdql EK)
Various EKs
ET CURRENT_EVENTS SUSPICIOUS JAR Download by Java UA with non JAR EXT matches various EKs
ET CURRENT_EVENTS Evil Redirector Leading to EK Feb 11 2015 Banner
ET CURRENT_EVENTS Evil Redirector Leading to EK Feb 11 2015 Blog
ET CURRENT_EVENTS Evil Redirector Leading to EK Mar 06 2015
ET CURRENT_EVENTS Evil Redirector Leading to EK Mar 19 2015
Magnitude EK
ET CURRENT_EVENTS Magnitude EK (formerly Popads) - Font Exploit - 32HexChar.eot
Nuclear
ET CURRENT_EVENTS DRIVEBY Nuclear EK SWF
ET CURRENT_EVENTS DRIVEBY Nuclear EK SWF M2
ET CURRENT_EVENTS DRIVEBY Nuclear EK Payload
ET CURRENT_EVENTS DRIVEBY Nuclear EK SilverLight M2
ET CURRENT_EVENTS DRIVEBY Nuclear EK Landing Feb 03 2015 M2
RIG
ET CURRENT_EVENTS Evil Flash Redirector to RIG EK Dec 17 2014
ET CURRENT_EVENTS RIG EK Landing March 20 2015
Magnitude IE
ET CURRENT_EVENTS Possible Magnitude IE EK Payload Nov 8 2013
ETPRO CURRENT_EVENTS DRIVEBY Magnitude IE Exploit Dec 03 2014
ETPRO CURRENT_EVENTS DRIVEBY Magnitude Landing Dec 03 2014
Neutrino
ET CURRENT_EVENTS Job314/Neutrino Reboot EK Payload Nov 20 2014
ET CURRENT_EVENTS Job314/Neutrino Reboot EK Flash Exploit Nov 20 2014
Archie
ET CURRENT_EVENTS Possible Internet Explorer CVE-2014-6332 Common Construct b64 1 (Observed in Archie EK)
Fiesta
ET CURRENT_EVENTS FiestaEK js-redirect
Angler
ET CURRENT_EVENTS Angler EK Payload DL M1 Feb 06 2015
ET CURRENT_EVENTS Angler EK Payload DL M2 Feb 06 2015
ET CURRENT_EVENTS Possible Angler EK Flash Exploit URI Structure Jan 21 2015
ET CURRENT_EVENTS DRIVEBY Angler EK Landing Feb 04 2014 T1
ETPRO CURRENT_EVENTS Angler EK Landing T1 Feb 16 2015 M2
ETPRO CURRENT_EVENTS Angler EK Payload T1 Feb 16 2015 M2
ETPRO CURRENT_EVENTS Angler EK Flash T1 Feb 16 2015 M2
Driveby
ET CURRENT_EVENTS Driveby bredolab hidden div served by nginx
ET CURRENT_EVENTS DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested com.class
ET CURRENT_EVENTS DRIVEBY GENERIC ShellExecute in Hex No Seps