ET MALWARE Unattributed WebShell Access - Command Execution

SID: 2034501Rev: 10 views
History
Sourceet/open
CreatedNovember 18, 2021
UpdatedNovember 18, 2021
Classificationattempted-admin
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE Unattributed WebShell Access - Command Execution"; flow:established,to_server; http.uri; content:"exec_code=put"; fast_pattern; content:"delimiter="; content:!"dst="; reference:url,thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/; classtype:attempted-admin; sid:2034501; rev:1; metadata:created_at 2021_11_18, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_11_18;)

References

urlthedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/

Metadata

created at2021_11_18
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2021_11_18

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!