Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Observed FxCodeShell Web Shell Password"; flow:established,to_server; http.request_body; content:"FxxkMyLie1836710Aa"; classtype:trojan-activity; sid:2027514; rev:3; metadata:affected_product Web_Server_Applications, attack_target Client_Endpoint, created_at 2019_06_25, deployment Perimeter, malware_family FxCodeShell, performance_impact Low, signature_severity Major, updated_at 2020_08_31;)