""ET WEB_SERVER HTTP Request to a *.54dfa1cb.com domain - Anuna Checkin - Compromised PHP Site""
SID: 2023234
Revision: 2
Class Type: bad-unknown
Metadata: affected_product Apache_HTTP_server, affected_product PHP, attack_target Web_Server, created_at 2016_09_15, deployment Datacenter, signature_severity Critical, updated_at 2022_11_21
Reference:
Protocol: tcp
Source Network: $HTTP_SERVERS
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
- Value: "54dfa1cb.com"
Within:
PCRE: "/^Host\x3a\x20[^\r\n]+54dfa1cb.com[\r\n]$/Hmi"
Special Options:
- http_header