Sagan unknown stable other

[FIPAYPIN] Replace macro from outside RFC1918

[FIPAYPIN] Replace macro from outside RFC1918

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[FIPAYPIN] Replace macro from outside RFC1918"; content: "S-300000"; content: "RTS1_IP"; meta_content:!"value ''%sagan%", $RFC1918; default_proto: tcp; classtype: misc-activity; program: *FIPAYPIN*; sid:5002770; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...