alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET MALWARE Cknife Shell Command Struct Inbound (aspx)"; flow:established,to_server; http.method; content:"POST"; http.user_agent; content:"Java"; startswith; http.request_body; content:"=Response.Write"; depth:18; fast_pattern; content:"eval"; distance:0; http.header_names; strip_pseudo_headers; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; content:"|0d 0a|user-agent|0d 0a|"; startswith; reference:url,www.recordedfuture.com/web-shell-analysis-part-2; classtype:trojan-activity; sid:2022977; rev:6; metadata:attack_target Web_Server, created_at 2016_07_20, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2024_04_29;)