SHELLCODE: X86 Linux Reverse Connect Detection Over HTTP

This signature detects payloads being transferred over network that have been using x86 linux reserve connect. This may be an indication of someone trying to evade anti-virus/IPS solutions and possibly drop malicious code.

Short Name
SHELLCODE:X86:REVERS-CONECT-80
Severity
Critical
Recommended
True
Recommended Action
Drop
Category
SHELLCODE
Keywords
Connect Detection HTTP Linux Over Reverse X86
Release Date
08/12/2015
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3324
False Positive
Unknown

Found a potential security threat?