alert http any any -> any any (msg:"ET CURRENT_EVENTS Dell Kace backdoor"; flow:established,to_server; http.method; content:"POST"; http.uri.raw; content:"/kbot_upload.php"; fast_pattern; nocase; content:"filename=db.php"; nocase; distance:0; content:"machineId="; nocase; pcre:"/(?:\.\.\/)+kboxwww\/tmp\//Ri"; http.request_body; content:"KSudoClient.class.php"; nocase; content:"KSudoClient|3a 3a|RunCommand"; distance:0; reference:url,console-cowboys.blogspot.com/2014/03/the-curious-case-of-ninjamonkeypiratela.html; classtype:attempted-admin; sid:2018263; rev:3; metadata:created_at 2014_03_13, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_13;)