Signature Detail
Short Name |
HTTP:STC:IE:IFRAME-SMB |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
smb |
Release Date |
2004/07/14 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Internet Explorer "IFRAME" Tag SMB Source
This signature detects an HTML file containing an "IFRAME" tag with a source set that points to a location on an SMB share. Attackers can be attempting to deliver malware to the target system. Note: Network administrators can use this technique for legitimate purposes.
Extended Description
IFRAME tags pointing to SMB share resources may indicate that an attack is being attempted, though legitimate uses do exist.
References