""ET EXPLOIT FireEye Appliance Unauthorized File Disclosure""
SID: 2021756
Revision: 4
Class Type: trojan-activity
Metadata: created_at 2015_09_10, updated_at 2015_09_10
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: $HTTP_PORTS
Flow: established,to_server
Contents:
-
Value: "/NEI_ModuleDispatch.php"
-
Value: "module=NEI_AdvancedConfig"
-
Value: "&function=HapiGetFileContents"
Within:
PCRE: "/(?:%2(?:52e(?:%2(?:52e(?:%(?:(?:25)?2|c0%a)f|\/)|e(?:%(?:(?:25)?2|c0%a)f|\/))|.(?:%(?:(?:25)?2|c0%a)f|\/))|e(?:%2(?:52e(?:%(?:(?:25)?2|c0%a)f|\/)|e(?:%(?:(?:25)?2|c0%a)f|\/))|.(?:%(?:(?:25)?2|c0%a)f|\/)))|.(?:%2(?:52e(?:%(?:(?:25)?2|c0%a)f|\/)|e(?:%(?:(?:25)?2|c0%a)f|\/))|.(?:%(?:(?:25)?2|c0%a)f|\/)))/Ii"
Special Options:
-
http_uri
-
http_uri
-
http_uri