Rule Info
Name
WEBSHELL_SECRETSAUCE_Jul23_1
Author
Florian Roth
Description
Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)
Score
85
Date
2023-07-24
Minimum Yara
1.7
Rule Hash
9ae8445b8f964be8f574a93032aa5a46
Tags
['T1505_003', 'CVE_2023_3519', 'DEMO', 'WEBSHELL']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
3
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR