POW Proxy-over-Web Custom HTTP Headers
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Cortex XDR
