HTTP: IIS Sensepost.exe Hacker Tool Probe

This signature detects attempts to locate sensepost.exe on a Microsoft ISS Web Server. Attackers can use a proof-of-concept hacking tool to break into a vulnerable Web server, then copy cmd.exe to the Web server script directory, and rename it sensepost.exe to avoid detection by log viewers. To identify this event, check your Web server logs for details--if the server returned a "200" to the request, your Web server might be compromised.

Extended Description

Successful access of sensepost.exe allows a remote attacker to execute malicious commands using the privileges of the IIS user.

References

URL: http://www.juniper.net/security/auto/vulnerabilities/vuln1290.html

Short Name

HTTP:IIS:SENSEPOST.EXE

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: IIS Sensepost.exe Hacker Tool Probe

Extended Description

References

Found a potential security threat?