RULE(RULE ID:323716)

Rule General Information
Release Date: 2019-10-22
Rule Name: Webshell Tool Antsword Detection - PHP Webshell Communication
Severity:
CVE ID:
Rule Protection Details
Description: Antsword is an open source cross-platform WebShell management tool developed by Chinese security researchers. Antsword can manage multiple shells on the attacked host, allowing penetration testers to easily execute commands, upload and download files, and more.This rule is used to detect Antsword PHP type Communication Webshell traffic.
Impact: An attacker could exploit this vulnerability to have unspecified effect.
Affected OS: Windows, Others
Reference: https://github.com/AntSwordProject/antSword
Solutions
Users should scan server content to see if Trojan horse files exist.