""ET WEB_SERVER LEMURLOOT WebShell Interaction Header (X-siLock-Comment) - Observed in MOVEit File Transfer - OUTBOUND (Active Compromise)""

SID: 2046048

Revision: 2

Class Type: successful-admin

Metadata: attack_target Web_Server, created_at 2023_06_02, deployment Perimeter, deployment SSLDecrypt, malware_family LEMURLOOT, performance_impact Low, confidence High, signature_severity Critical, tag WebShell, updated_at 2023_06_05

Reference:

Protocol: tcp

Source Network: [$HOME_NET,$HTTP_SERVERS]

Source Port: any

Destination Network: any

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "X-siLock-Comment|3a 20|"

  • Value: "comment"

Within: 7

PCRE:

Special Options:

  • http_header

  • fast_pattern

  • nocase

  • http_header

source