Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[SYSLOG] Illegal root login"; pcre: "/ILLEGAL ROOT LOGIN
| ROOT LOGIN REFUSED/"; classtype: unsuccessful-admin; sid: 5000120; rev:1;)Field Validations
Loading…
Comments (0)
Loading comments...