""ET CURRENT_EVENTS Webshell Execute Command Inbound - Possibly Iran-based M1""

SID: 2033419

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Server, created_at 2021_07_25, deployment Perimeter, signature_severity Major, tag WebShell, updated_at 2021_07_25, mitre_tactic_id TA0003, mitre_tactic_name Persistence, mitre_technique_id T1505, mitre_technique_name Server_Software_Component

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "__VIEWSTATE=" Depth: 12

  • Value: "&txtAuthKey=20TyG6eQqEopbFMB&txtCommand="

Within:

PCRE:

Special Options:

  • http_method

  • http_client_body

  • fast_pattern

  • http_client_body

source