""ET WEB_SERVER WebShell - Romanian Webshell""
SID: 2016577
Revision: 4
Class Type: bad-unknown
Metadata: created_at 2013_03_14, updated_at 2013_03_14
Reference:
Protocol: tcp
Source Network: $HTTP_SERVERS
Source Port: $HTTP_PORTS
Destination Network: $EXTERNAL_NET
Destination Port: any
Flow: established,to_client
Contents:
-
Value: "Incarca fisier|3a|"
-
Value: "Exeuta comada|3a|"
Within:
PCRE:
Special Options:
- file_data