Chinotto Python Backdoor Exfiltrating exec() Output via Base64 POST

Ibrahim Saud@tektrix

•updated 18 days ago•0•0•1

Detects HTTP POST requests to a known suspicious endpoint ('/board.php') often used by the Chinotto Python backdoor. The rule monitors for outgoing web traffic containing 'data=' parameters or connections to known malicious domains, indicating potential exfiltration of base64-encoded command output.