ET WEB_SERVER China Chopper WebShell Observed Outbound

7.0.35.0SID: 2027341Rev: 5Enabled5 views
Sourceet/open
Fileemerging-web_server.rules
CreatedMay 9, 2019
UpdatedMarch 7, 2024
Classificationtrojan-activity
alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER China Chopper WebShell Observed Outbound"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"<%@|20|Page|20|Language=|22|Jscript|22|%><eval|28|Request.Item|5b|"; fast_pattern; content:"|22 29 3b|%>"; within:50; classtype:trojan-activity; sid:2027341; rev:5; metadata:created_at 2019_05_09, performance_impact Low, signature_severity Major, updated_at 2024_03_07;)

Metadata

created at2019_05_09
performance impactLow
signature severityMajor
updated at2024_03_07

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!