Signature Detail

HTTP: IIS Sensepost.exe Hacker Tool Probe

This signature detects attempts to locate sensepost.exe on a Microsoft ISS Web Server. Attackers can use a proof-of-concept hacking tool to break into a vulnerable Web server, then copy cmd.exe to the Web server script directory, and rename it sensepost.exe to avoid detection by log viewers. To identify this event, check your Web server logs for details--if the server returned a "200" to the request, your Web server might be compromised.

Extended Description

Successful access of sensepost.exe allows a remote attacker to execute malicious commands using the privileges of the IIS user.

References

• URL: http://www.juniper.net/security/auto/vulnerabilities/vuln1290.html