Rule History

SID: 2017701 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 5 • Nov 9, 2013, 12:00 PM

Message:

ET ATTACK_RESPONSE webr00t WebShell Access

Rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ATTACK_RESPONSE webr00t WebShell Access"; flow:established,to_server; http.uri; content:"/?webr00t="; reference:url,blog.sucuri.net/2013/11/case-study-analyzing-a-wordpress-attack-dissecting-the-webr00t-cgi-shell-part-i.html; classtype:trojan-activity; sid:2017701; rev:5; metadata:created_at 2013_11_09, signature_severity Major, updated_at 2020_08_18;)

Created:

Nov 9, 2013, 12:00 PM

Updated:

Aug 18, 2020, 12:00 PM

DB Created:

Nov 9, 2013, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-attack_response.rules