Sagan critical stable other

[SYSLOG] Physical root login

[SYSLOG] Physical root login

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[SYSLOG] Physical root login"; content: "ROOT LOGIN  on"; nocase; classtype: successful-admin; sid: 5000122; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...