Sagan informational stable other

[ARP] arpwatch - Broadcast address detected

[ARP] arpwatch - Broadcast address detected

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[ARP] arpwatch - Broadcast address detected"; content: "ethernet broadcast"; classtype: network-event; program: arpwatch; sid: 5001062; rev:3; metadata: mitre_technique_id T1046, mitre_technique_id T1065;)

Field Validations

Loading…

Comments (0)

Loading comments...