ET MALWARE Possible STEADYPULSE Webshell Accessed M1

Query · suricata

flow:from_server,established;
http.stat_code;
content:"200";
file.data;
content:"<form action=|22||22| method=|22|GET|22|>";
content:"<input type=|22|text|22| name=|22|cmd|22| "; distance:0;
content:"<input type=|22|text|22| name=|22|serverid|22| "; distance:0; fast_pattern;
content:"<input type=|22|submit|22| value=|22|Run|22|>"; distance:0;
Raw source ET MALWARE Possible STEADYPULSE Webshell Accessed M1 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (
    msg:"ET MALWARE Possible STEADYPULSE Webshell Accessed M1";
    flow:from_server,established;
    http.stat_code;
    content:"200";
    file.data;
    content:"<form action=|22||22| method=|22|GET|22|>";
    content:"<input type=|22|text|22| name=|22|cmd|22| "; distance:0;
    content:"<input type=|22|text|22| name=|22|serverid|22| "; distance:0; fast_pattern;
    content:"<input type=|22|submit|22| value=|22|Run|22|>"; distance:0;
    reference:url,www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html;
    classtype:attempted-user;
    sid:2032801; rev:1;
    metadata:created_at 2021_04_21, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_04_21;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.