INDICATOR-SCAN -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. This alert showed because Snort has detected a tool or script attempting to find objects on the network. This could be as simple as pinging a specific port that WordPress admins commonly use to see if a WordPress-targeted attack might succeed, or it could be as complex as attempting to create a map of the entire network, including ports, services, and devices. Snort scans the signature of this attempt to determine if it is different from the allowed network scanning tools (such as NMAP), and is therefore likely an attack.
INDICATOR-SCAN PHP backdoor scan attempt
This event is generated when the Peppa Pig botnet scans a potentially vulnerable php endpoint to determine if a backdoor has been previously installed.
Web Application Attack
Rule will alert on botnet vulnerability scan attempts to check for backdoors from previous infections. Unaffected servers will not send response to scan attempt.
Ease of Attack:
What To Look For
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
For reference, see the MITRE ATT&CK vulnerability types here:
CVE Additional Information