Skip to content

Instantly share code, notes, and snippets.

@x0rz

x0rz/wordpress_snort.rules

Last active September 29, 2017 05:56
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save x0rz/32e51408c3d0d02bde5cf0ce5105196d to your computer and use it in GitHub Desktop.
Save x0rz/32e51408c3d0d02bde5cf0ce5105196d to your computer and use it in GitHub Desktop.
Download ZIP
Snort rule replacing sid:26576 to detect more second stage download attempts (may raise false positives - to be tested)
Raw
wordpress_snort.rules
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC possible infected wordpress second stage download attempt"; flow:to_server,established; http_uri; pcre:"/\/wp-(includes|admin|content)\/.*\.(exe|dll|scr|rar|zip|jar|ps1|bat)/iU";metadata:service http; reference:url,medium.com/@x0rz/threat-hunting-on-simple-tricks-27e64e39f2f0; classtype:trojan-activity; sid:31337; rev:1;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment