""ET ATTACK_RESPONSE net user Command Output via HTTP POST""

SID: 2038604

Revision: 1

Class Type: successful-user

Metadata: attack_target Client_Endpoint, created_at 2022_08_24, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2022_08_24

Reference:

  • md5

  • 91dc943c9e8fd0d4de54228823f9f26b

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "User name|20 20 20|"

  • Value: "|0d 0a|Full Name|20 20 20|"

  • Value: "|0d 0a|Account active|20 20 20|"

  • Value: "|0d 0a 0d 0a|Password last set|20 20 20|"

  • Value: "|0d 0a|User may change password|20 20 20|"

  • Value: "|0d 0a 0d 0a|Workstations allowed|20 20 20|"

Within:

PCRE:

Special Options:

  • http_method

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • fast_pattern

  • http_client_body

source