Rule History

SID: 2027341 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 4 • May 9, 2019, 12:00 PM

Message:

ET WEB_SERVER China Chopper WebShell Observed Outbound

Rule:

alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER China Chopper WebShell Observed Outbound"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"<%@|20|Page|20|Language=|22|Jscript|22|%><eval|28|Request.Item|5b|"; fast_pattern; content:"|22 29 3b|%>"; within:50; classtype:trojan-activity; sid:2027341; rev:4; metadata:created_at 2019_05_09, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)

Created:

May 9, 2019, 12:00 PM

Updated:

Nov 18, 2020, 12:00 PM

DB Created:

May 9, 2019, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-web_server.rules