Sagan high stable other

[SCREENCONNECT] Suspicious Discovery Command (net)

[SCREENCONNECT] Suspicious Discovery Command (net)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[SCREENCONNECT] Suspicious Discovery Command (net)"; program:screenconnect-restful-api_data; meta_content:"
| 22
| EventType
| 22 3a
| %sagan%",44,70; meta_content:"net %sagan%",view,config,group,user,localgroup; meta_nocase; parse_src_ip:1; classtype:suspicious-command; sid:5015121; rev:2; metadata:created_at 2024_09_03, updated_at 2024_10_10;)

Field Validations

Loading…

Comments (0)

Loading comments...