Sagan high stable other

[SCREENCONNECT] Bluedot Detected a Connection from a Malicious IP Address

[SCREENCONNECT] Bluedot Detected a Connection from a Malicious IP Address

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[SCREENCONNECT] Bluedot Detected a Connection from a Malicious IP Address"; program:screenconnect-restful-api_data; content:"
| 22
| EventType
| 22 3a
| 10"; json_map:"src_ip",".Session.ActiveConnections[].NetworkAddress"; bluedot:type ip_reputation, track by_src,none,Malicious,Tor; classtype:attempted-user; sid:5015098; rev:3; metadata:created_at 2024_09_03, updated_at 2024_10_10;)

Field Validations

Loading…

Comments (0)

Loading comments...