topic Re: AWStats configdir exec in Network Security

AWStats configdir exec

shiznitide — Sun, 10 Mar 2019 11:13:20 GMT

In the past week, I have received a plethera of alerts with this High Level title. After blacklisting the host IP it is back with a different one. I am starting to get concerned because the first IP address that was blacklisted was a hacker.

Can someone tell me if this is a false positive or not?

Or, what is actually setting this sensor off?

Re: AWStats configdir exec

mhellman — Mon, 28 Jul 2008 16:46:58 GMT

That signatures fires on a match of an attempt to call the awstats.pl cgi script with a parameter of configdir and a parameter value containing a ";" or "|". It seems pretty unlikely to be a false positive in the sense that it is probably not legitimate traffic. It isn't necessarily a hacker targeting your systems...it may just be a worm or script that scans the Internets looking for vulnerable systems.

Do you use awstats?

Re: AWStats configdir exec

shiznitide — Tue, 29 Jul 2008 11:04:25 GMT

Not really sure. I don't use it myself but honestly someone inside the network could be. I just get the alerts, do the research, pass-on advice, etc...Thanks for the help.