rule asp_twoface_w0 {
	meta:
		author = "jaime.blasco@alienvault.com"
		tlp = "WHITE"
		reference = "https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/asp.twoface"
        malpedia_version = "20190503"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

	strings:
		$header = "<%@ Page Language="
		$var1 = "pwd=t[\"pwd\"];"
		$var2 = "pro=t[\"pro\"];"
		$var3 = "cmd=t[\"cmd\"];"
		$xvar1 = "pwd=fb(t[\"pwd\"]);"
		$xvar2 = "pro=fb(t[\"pro\"]);"
		$xvar3 = "cmd=fb(t[\"cmd\"]);"		

	condition:
		$header and ((all of ($var*)) or (all of ($xvar*)))
}