""ET EXPLOIT Metasploit Plugin-Detect Posting Data 5""

SID: 2020752

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Any, attack_target Client_and_Server, created_at 2015_03_26, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2015_03_26

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "Jm9zX3ZlbmRvcj"

Within:

PCRE:

Special Options:

• http_method

• http_client_body

source