""ET WEB_SERVER Gootkit Website Infection Receiving FTP Credentials from Control Server""
SID: 2011287
Revision: 2
Class Type: web-application-attack
Metadata: created_at 2010_09_28, updated_at 2010_09_28
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: $HTTP_PORTS
Destination Network: $HTTP_SERVERS
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "
" -
Value: "
" -
Value: "
" -
Value: "
21 "
Within:
PCRE:
Special Options:
-
nocase
-
nocase
-
nocase
-
nocase