Sagan critical stable other

[COURIER] Courierpassd|Poppassd - Changed user password

[COURIER] Courierpassd|Poppassd - Changed user password

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[COURIER] Courierpassd
| Poppassd - Changed user password"; content: "changed POP3"; classtype: successful-user; program: courierpassd
| poppassd; sid: 5001103; rev:3; metadata: mitre_technique_id T1078;)

Field Validations

Loading…

Comments (0)

Loading comments...