ET EXPLOIT Possible Cisco IOS XE Web Server Implant 404 Response (CVE-2023-20198) (Outbound) M2
Sourceet/open
CreatedOctober 23, 2023
UpdatedOctober 23, 2023
Classificationattempted-recon
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Cisco IOS XE Web Server Implant 404 Response (CVE-2023-20198) (Outbound) M2"; flow:established,to_client; http.response_body; content:"|3c|head|3e 3c|title|3e|404|20|Not|20|Found|3c 2f|title|3e 3c 2f|head|3e|"; content:"|3c|center|3e 3c|h1|3e|404|20|Not|20|Found|3c 2f|h1|3e 3c 2f|center|3e|"; content:"|3c|hr|3e 3c|center|3e|openresty|3c 2f|center|3e|"; fast_pattern; flowbits:isset,ET.CVE-2023-20198.Inbound; reference:url,github.com/fox-it/cisco-ios-xe-implant-detection; reference:cve,2023-20198; reference:url,twitter.com/SI_FalconTeam/status/1716497899821941230; classtype:attempted-recon; sid:2048741; rev:1; metadata:attack_target Networking_Equipment, created_at 2023_10_23, cve CVE_2023_20198, deployment Perimeter, deployment SSLDecrypt, performance_impact Significant, confidence Low, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_10_23, reviewed_at 2023_10_23;)
References
Metadata
attack targetNetworking_Equipment
created at2023_10_23
deploymentSSLDecrypt
performance impactSignificant
confidenceLow
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2023_10_23
reviewed at2023_10_23
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!