""ET WEB_SERVER Possible bash shell piped to dev udp Inbound to WebServer""

SID: 2019314

Revision: 2

Class Type: bad-unknown

Metadata: created_at 2014_09_29, updated_at 2014_09_30

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "/dev/udp/"

Within:

PCRE:

Special Options:

source