""ET WEB_SERVER SUSPICIOUS Possible WebShell Login Form (Outbound)""

SID: 2018459

Revision: 1

Class Type: trojan-activity

Metadata: created_at 2014_05_09, updated_at 2014_05_09

Reference:

• Link

Protocol: tcp

Source Network: $HTTP_SERVERS

Source Port: $HTTP_PORTS

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,from_server

Contents:

• Value: "

  Password|3a| >|27|>

  "

Within: 120

PCRE:

Special Options:

• file_data

source