ET MALWARE Possible MSIL/Solorigate.G!dha/SUPERNOVA Webshell Access Request

alert http any any -> any any (
    msg:"ET MALWARE Possible MSIL/Solorigate.G!dha/SUPERNOVA Webshell Access Request";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/logoimagehandler.ashx";
    content:"clazz="; fast_pattern;
    content:"method=";
    content:"args=";
    content:"codes=";
    http.header_names;
    content:!"Referer";
    reference:url,www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect;
    reference:url,unit42.paloaltonetworks.com/solarstorm-supernova;
    classtype:trojan-activity;
    sid:2031436; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2020_12_21, deployment Perimeter, malware_family Solorigate, confidence Medium, signature_severity Major, updated_at 2020_12_21, reviewed_at 2024_03_05;
)