""ET WEB_SERVER Suspected China Chopper Variant Webshell Command (inbound)""

SID: 2038490

Revision: 1

Class Type: attempted-admin

Metadata: attack_target Web_Server, created_at 2022_08_11, deployment Perimeter, signature_severity Major, updated_at 2022_08_11, reviewed_at 2024_05_07

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "kfaero=" Depth: 7

  • Value: "&Z1="

  • Value: "&Z2="

Within: 5

PCRE:

Special Options:

  • http_method

  • fast_pattern

  • http_client_body

  • http_client_body

  • http_client_body

source