ET WEB_SERVER DNS Query for Suspicious 33db9538.com Domain - Anuna Checkin - Compromised PHP Site - Suricata Rule 2023227 (et/open)

ET WEB_SERVER DNS Query for Suspicious 33db9538.com Domain - Anuna Checkin - Compromised PHP Site

7.0.3 5.0SID: 2023227Rev: 7Enabled3 views

Fileemerging-web_server.rules

CreatedSeptember 15, 2016

UpdatedApril 13, 2024

Classificationtrojan-activity

alert dns $HTTP_SERVERS any -> any any (msg:"ET WEB_SERVER DNS Query for Suspicious 33db9538.com Domain - Anuna Checkin - Compromised PHP Site"; dns.query; content:"33db9538.com"; startswith; fast_pattern; endswith; nocase; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2015-111911-4342-99&tabid=2; reference:url,security.stackexchange.com/questions/47253/hacked-site-encrypted-code; classtype:trojan-activity; sid:2023227; rev:7; metadata:affected_product Apache_HTTP_server, affected_product PHP, attack_target Web_Server, created_at 2016_09_15, deployment Datacenter, confidence Medium, signature_severity Critical, updated_at 2024_04_13;)

References

url	www.symantec.com/security_response/writeup.jsp?docid=2015-111911-4342-99&tabid=2
url	security.stackexchange.com/questions/47253/hacked-site-encrypted-code

Metadata

affected productPHP

attack targetWeb_Server

created at2016_09_15

deploymentDatacenter

confidenceMedium

signature severityCritical

updated at2024_04_13

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!