Sourcefire detected a
SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. Some of the logs included a user-agent string mentioning Googlebot2.0, but doing a reverse IP lookup, the IP doesn't resolve to anything, so I'm guessing it is spoofed.
Now the question is, is this exploit visible in the packet (.asp +.jpg), or Sourcefire captured just one of the execution attempts? Can someone explain the anatomy of this attack?
.PV..4. I.....`#..E..s.f@....2.!%. .....P.**..l..P..<._..HEAD /Ac2.asp;.jpg HTTP/1.1 User-Agent: IE 10.0 Host: www.*****.com