Skip to content

Instantly share code, notes, and snippets.

@stamparm

stamparm/drupalgeddon2.rules

Last active October 16, 2018 22:06
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save stamparm/0cfd0d6a2a906fde2e1cb527262fb8d5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save stamparm/0cfd0d6a2a906fde2e1cb527262fb8d5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. stamparm renamed this gist Apr 13, 2018. 1 changed file with 0 additions and 0 deletions.
    0 drupalgeddon.rules → drupalgeddon2.rules
    View file
    File renamed without changes.
  2. stamparm revised this gist Apr 13, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion drupalgeddon.rules
    View file
    Original file line number Diff line number Diff line change
    @@ -1 +1 @@
    alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"Drupalgeddon (CVE-2018-7600)"; flow: to_server,established; content:"POST"; http_method; content:"markup"; fast_pattern; content: "/user/register"; http_uri; pcre:"/(access_callback|pre_render|lazy_builder|post_render)/i"; classtype:web-application-attack; sid:9000110; rev:1;)
    alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"Drupalgeddon2 (CVE-2018-7600)"; flow: to_server,established; content:"POST"; http_method; content:"markup"; fast_pattern; content: "/user/register"; http_uri; pcre:"/(access_callback|pre_render|lazy_builder|post_render)/i"; classtype:web-application-attack; sid:9000110; rev:1;)
  3. stamparm renamed this gist Apr 13, 2018. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → drupalgeddon.rules
    View file
    File renamed without changes.
  4. stamparm revised this gist Apr 13, 2018. No changes.
  5. stamparm created this gist Apr 13, 2018.
    1 change: 1 addition & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"Drupalgeddon (CVE-2018-7600)"; flow: to_server,established; content:"POST"; http_method; content:"markup"; fast_pattern; content: "/user/register"; http_uri; pcre:"/(access_callback|pre_render|lazy_builder|post_render)/i"; classtype:web-application-attack; sid:9000110; rev:1;)