TGI HUNT Malicious Chunk-Proxy Webshell Artifacts in HTTP Response

SID: 2610869Rev: 1103 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationbad-unknown
alert http $HOME_NET any -> any any (msg:"TGI HUNT Malicious Chunk-Proxy Webshell Artifacts in HTTP Response"; flow:established,to_client; http.response_header; content:"status|3a 20|"; pcre:"/^(?:close|successfully)/R"; threshold:type limit, track by_src, seconds 60, count 1; reference:url,travisgreen.net/updates/20240123; classtype:bad-unknown; sid:2610869; rev:1;)

References

urltravisgreen.net/updates/20240123

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!