Sagan high stable other

[SCREENCONNECT] Suspicious Discovery Command (ipconfig)

[SCREENCONNECT] Suspicious Discovery Command (ipconfig)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[SCREENCONNECT] Suspicious Discovery Command (ipconfig)"; program:screenconnect-restful-api_data; meta_content:"
| 22
| EventType
| 22 3a
| %sagan%",44,70; content:"ipconfig"; parse_src_ip:1; classtype:suspicious-command; sid:5015120; rev:2; metadata:created_at 2024_09_03, updated_at 2024_10_10;)

Field Validations

Loading…

Comments (0)

Loading comments...