Sagan critical stable other

[FORTINET] Botnet Communication Detected

[FORTINET] Botnet Communication Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[FORTINET] Botnet Communication Detected"; content:"trigger=Default-Botnet-Communication-Detection-By-"; meta_content:!"action=
| 22
| %sagan%
| 22
| ",dropped,blocked; parse_src_ip:2; reference:url,https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/ef4bde1e-412e-11ee-8e6d-fa163e15d75b/FortiAnalyzer-7.4.1-Administration_Guide.pdf; content:"- - - -"; classtype:trojan-activity; sid:5017300; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...