Sagan medium stable other

[DARKTRACE] A device is making new internal connections to a range of internal hosts consistent with network scanning

[DARKTRACE] A device is making new internal connections to a range of internal hosts consistent with network scanning

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[DARKTRACE] A device is making new internal connections to a range of internal hosts consistent with network scanning"; program: darktrace; content: "Device"; content: "Network Scan - Low Anomaly Score"; parse_src_ip: 1; xbits: set,exploit_attempt,track ip_src,expire 21600; classtype: bad-unknown; sid:5005898; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...