Sagan unknown stable other

[FTPD] Multiple failed login attempts

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[FTPD] Multiple failed login attempts"; content: "repeated login failures"; xbits: set,brute_force, track ip_src, expire 21600; default_proto: tcp; default_dst_port: $FTP_PORT; classtype: misc-attack; program: ftpd
| ftp
| FTP
| FTPD; sid:5000190; rev:8;)

Field Validations

Loading…

Comments (0)

Loading comments...