aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rules: add SSH decoder events rules

Browse Source
pull/4971/head
Philippe Antoine 5 years ago committed by Victor Julien
parent 69b4fffdae
commit 5a98035bac
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File

10
rules/ssh-events.rules
Unescape Escape View File

@ -0,0 +1,10 @@
# SSH app layer event rules
#
# SID's fall in the 2228000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
#
# These sigs fire at most once per connection.
#
alert ssh any any -> any any (msg:"SURICATA SSH invalid banner"; flow:established; app-layer-event:ssh.invalid_banner; classtype:protocol-command-decode; sid:2228000; rev:1;)
alert ssh any any -> any any (msg:"SURICATA SSH too long banner"; flow:established; app-layer-event:ssh.long_banner; classtype:protocol-command-decode; sid:2228001; rev:1;)
alert ssh any any -> any any (msg:"SURICATA SSH invalid record"; flow:established; app-layer-event:ssh.invalid_record; classtype:protocol-command-decode; sid:2228002; rev:1;)
Write Preview
Loading…
Cancel
Save