EtherRAT Web Server Hijacking and Traffic Redirection
This rule detects potential web server hijacking and traffic redirection activities, specifically focusing on techniques used by EtherRAT. It identifies scenarios where Nginx or Apache configurations are modified, often preceded by backup creation, and followed by a web server restart. Additionally, it looks for instances where configuration modifications are combined with attempts to exfiltrate data to webhook.site, suggesting a malicious redirection setup.
Sigma
