WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26

rule WEBSHELL_Mailbox_Export_PST_ProxyShell_Aug26 {
   meta:
      description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
      author = "Moritz Oettle"
      reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
      date = "2021-09-04"
      score = 85
      id = "6aea414f-d27c-5202-84f8-b8620782fc90"
   strings:
      $x1 = "!BDN"  /* PST file header */

      $g1 = "Page language=" ascii
      $g2 = "<%@ Page" ascii
      $g3 = "Request.Item[" ascii
      $g4 = "\"unsafe\");" ascii
      $g5 = "<%eval(" ascii
      $g6 = "script language=" ascii
      $g7 = "Request[" ascii

      $s1 = "gold8899" ascii  /* HTTP Request Parameter */
      $s2 = "exec_code" ascii  /* HTTP Request Parameter */
      $s3 = "orangenb" ascii  /* HTTP Request Parameter */
   condition:
      filesize < 500KB and
      $x1 at 0 and
      (1 of ($s*) or 3 of ($g*))
}