Sagan informational stable other

[ARP] arpwatch - Ethernet mismatch [MAC != ARP]

[ARP] arpwatch - Ethernet mismatch [MAC != ARP]

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[ARP] arpwatch - Ethernet mismatch [MAC != ARP]"; content: " ethernet mismatch "; classtype: network-event; program: arpwatch; parse_src_ip: 1; sid: 5001064; rev:4; metadata: mitre_technique_id T1046, mitre_technique_id T1556;)

Field Validations

Loading…

Comments (0)

Loading comments...