ET RETIRED Papercut MF/NG User/Group Sync Python Backdoor Trigger

alert http any any -> $HOME_NET any (
    msg:"ET RETIRED Papercut MF/NG User/Group Sync Python Backdoor Trigger";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"/app";
    http.cookie;
    content:"JSESSIONID|3d|"; startswith;
    http.request_body;
    content:"service|3d|"; startswith;
    content:"inputUsername";
    content:"inputPassword"; fast_pattern;
    content:"|3d|import";
    reference:url,vulncheck.com/blog/papercut-rce;
    classtype:trojan-activity;
    sid:2045611; rev:2;
    metadata:affected_product HTTP_Server, attack_target Web_Server, created_at 2023_05_05, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category MALWARE, confidence High, signature_severity Major, tag Papercut_MF_NG, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_10_01, reviewed_at 2024_10_01;
    target:dest_ip;
)