ET WEB_CLIENT Generic Mini Webshell Accessed on External Compromised Server

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET WEB_CLIENT Generic Mini Webshell Accessed on External Compromised Server";
    flow:established,to_client;
    file.data;
    content:"<tr><td>Current Path : <a href=|22|?path=/"; nocase;
    content:"<tr class=|22|first|22|>"; nocase; distance:0;
    content:"<td><center>File/Folder Name</center></td>"; nocase; distance:0;
    content:"<td><center>Size</center></td>"; nocase; distance:0;
    content:"<td><center>Permissions</center></td>"; nocase; distance:0;
    content:"<td><center>Options</center></td>"; nocase; distance:0;
    content:"<td><center><form method=|22|POST|22 20|action=|22|?option&path="; nocase; distance:0; fast_pattern;
    content:"<td><a href=|22|?filesrc="; nocase; distance:0;
    content:"<option value=|22|delete|22|>Delete</option>"; nocase; distance:0;
    content:"<option value=|22|chmod|22|>Chmod</option>"; nocase; distance:0;
    content:"<option value=|22|rename|22|>Rename</option>"; nocase; distance:0;
    content:"<option value=|22|edit|22|>Edit</option>"; nocase; distance:0;
    classtype:web-application-attack;
    sid:2029888; rev:2;
    metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2020_04_13, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_13;
)