Sagan high stable other

[SCREENCONNECT] Suspicious Discovery Command (systeminfo)

[SCREENCONNECT] Suspicious Discovery Command (systeminfo)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[SCREENCONNECT] Suspicious Discovery Command (systeminfo)"; program:screenconnect-restful-api_data; meta_content:"
| 22
| EventType
| 22 3a
| %sagan%",44,70; meta_content:"nltest %sagan%",/domain_trusts,/all_trusts; meta_nocase; parse_src_ip:1; classtype:suspicious-command; sid:5015122; rev:2; metadata:created_at 2024_09_03, updated_at 2024_10_10;)

Field Validations

Loading…

Comments (0)

Loading comments...