Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
1 lines (1 sloc) 512 Bytes
alert tcp $EXTERNAL_NET any -> $SHAREPOINT_SERVERS [80,443] (msg:"SharePoint CVE-2019-0604 RCE Exploit Attempt"; flow:established,to_server; content:"POST"; http_method; content:"Picker.aspx?PickerDialogType=Microsoft.SharePoint"; http_uri; nocase; content:"ctl00|25|24PlaceHolderDialogBodySection|25|24ctl05|25|24hiddenSpanData|3d5f5f|";http_client_body; nocase; fast_pattern; reference:adraft.page/index.php/2019/09/14/cve-2019-0604-sharepoint-rce-forensics-analysis-and-detection-methods; sid:3000001; rev:1;)
You can’t perform that action at this time.