Rule History

SID: 2046627 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Jun 22, 2023, 12:00 PM

Message:

ET HUNTING Possible Node.js REPL Shell Banner - Reverse Shell

Rule:

alert tcp $HOME_NET any -> any any (msg:"ET HUNTING Possible Node.js REPL Shell Banner - Reverse Shell"; flow:established,to_server; content:"Welcome to Node.js"; reference:url,nodejs.dev/en/learn/how-to-use-the-nodejs-repl/; classtype:bad-unknown; sid:2046627; rev:1; metadata:attack_target Client_and_Server, created_at 2023_06_22, deployment Perimeter, performance_impact Low, confidence Low, signature_severity Major, tag Node_Reverse_Shell, updated_at 2023_06_22; target:src_ip;)

Created:

Jun 22, 2023, 12:00 PM

Updated:

Jun 22, 2023, 12:00 PM

DB Created:

Jun 22, 2023, 10:00 PM

DB Updated:

Jun 22, 2023, 10:00 PM

Filename:

rules/emerging-hunting.rules