CL0P MOVEit Webshell CVE 2023 34362

This YARA rule detects specific ASP.NET web shells associated with the CL0P ransomware gang's exploitation of the MOVEit Transfer vulnerability (CVE-2023-34362). It identifies malicious activity by looking for custom HTTP headers ('X-siLock-') used by the exploit, specific hardcoded Azure storage interaction code snippets, and characteristic SQL injection queries targeting the application's user database.