""ET EXPLOIT Ghostscript illegal delete bindnow attempt (SMTP)""

SID: 2026088

Revision: 1

Class Type: attempted-user

Metadata: attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, signature_severity Informational, updated_at 2018_09_05

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $SMTP_SERVERS

Destination Port: 25

Flow: to_server,established

Contents:

  • Value: "unlink("

  • Value: "|2E|bindnow"

  • Value: "stopped"

Within:

PCRE: "/\x2Ebindnow[^\x7D]\x7D\sstopped/smi"

Special Options:

  • file_data

  • fast_pattern

source