""ET CURRENT_EVENTS Webshell Access with Known Password Inbound - Possibly Iran-based""

SID: 2033418

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Server, created_at 2021_07_25, deployment Perimeter, signature_severity Major, tag WebShell, updated_at 2021_07_25, mitre_tactic_id TA0003, mitre_tactic_name Persistence, mitre_technique_id T1505, mitre_technique_name Server_Software_Component

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "name=|22|authKey|22 0d 0a 0d 0a|woanware|0d 0a|"

Within:

PCRE:

Special Options:

• http_method

• fast_pattern

• http_client_body

source