ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site - Suricata Rule 2023231 (et/open)

ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site

7.0.3 5.0SID: 2023231Rev: 6Enabled1 views

Fileemerging-web_server.rules

CreatedSeptember 15, 2016

UpdatedMarch 7, 2024

Classificationbad-unknown

alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site"; flow:established,to_server; http.host; content:"33db9538.com"; fast_pattern; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2015-111911-4342-99&tabid=2; reference:url,security.stackexchange.com/questions/47253/hacked-site-encrypted-code; classtype:bad-unknown; sid:2023231; rev:6; metadata:affected_product Apache_HTTP_server, affected_product PHP, attack_target Web_Server, created_at 2016_09_15, deployment Datacenter, signature_severity Critical, updated_at 2024_03_07;)

References

url	www.symantec.com/security_response/writeup.jsp?docid=2015-111911-4342-99&tabid=2
url	security.stackexchange.com/questions/47253/hacked-site-encrypted-code

Metadata

affected productPHP

attack targetWeb_Server

created at2016_09_15

deploymentDatacenter

signature severityCritical

updated at2024_03_07

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!