Sagan high stable other

[SCREENCONNECT] Connection from Outside HOME_COUNTRY

[SCREENCONNECT] Connection from Outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[SCREENCONNECT] Connection from Outside HOME_COUNTRY"; program:screenconnect-restful-api_data; content:"
| 22
| EventType
| 22 3a
| 10"; json_map:"src_ip",".Session.ActiveConnections[].NetworkAddress"; country_code:track by_src, isnot $HOME_COUNTRY; classtype:attempted-user; sid:5015099; rev:3; metadata:created_at 2024_09_03, updated_at 2024_10_10;)

Field Validations

Loading…

Comments (0)

Loading comments...