ET EXPLOIT HP Smart Storage Administrator Remote Command Injection

Query · suricata

flow:to_server,established;
content:"echo -n|20|";
pcre:"/^\s*(?:f0VMR|9FTE|\/RUxG)/R";
Raw source ET EXPLOIT HP Smart Storage Administrator Remote Command Injection · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp $EXTERNAL_NET any -> $HOME_NET 2381 (
    msg:"ET EXPLOIT HP Smart Storage Administrator Remote Command Injection";
    flow:to_server,established;
    content:"echo -n|20|";
    pcre:"/^\s*(?:f0VMR|9FTE|\/RUxG)/R";
    reference:cve,2016-8523;
    classtype:attempted-user;
    sid:2024063; rev:2;
    metadata:affected_product HP_Smart_Storage_Administrator, attack_target Server, created_at 2017_03_15, cve CVE_2016_8523, deployment Datacenter, performance_impact Low, confidence High, signature_severity Critical, updated_at 2019_07_26, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.