[CISCO-IOS] Web Login Successful - Public IP Address

alert any $HOME_NET any -> $HOME_NET any (msg:"[CISCO-IOS] Web Login Successful - Public IP Address"; content:"%SEC_LOGIN-5-WEBLOGIN_SUCCESS
| 3a
| "; content:"Source
| 3a
| "; pcre:"/Source\:\s(\d+)(?<!10)\.(\d+)(?<!192\.168)(?<!172\.(1[6-9]
| 2\d
| 3[0-1]))\.(\d+)\.(\d+)/"; reference:cve,2023-20198; reference:url,www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html; reference:url,blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/; classtype:targeted-activity; sid:5013942; rev:1; metadata:deployment Server,affected_product cisco_ios_xe,affected_version all,mitigation www.cisco.com/c/en/us/support/docs/csa/cisco-sa-iosxe-webui-privesc-j22SaA4z.html,deprecation_reason NONE,tag cve, created_at 2023_10_17, updated_at 2023_10_17, mitre_tactic_id TA0004, mitre_technique_id T1068;)