2 lines
191 B
Plaintext
2 lines
191 B
Plaintext
|
alert tcp any any -> $HOME_NET any (flow:to_server,established; msg:"Indecent Powershell LOGIN"; content: "LOGIN| 7c 2a 7c |"; pcre:"/LOGIN\|\*\|[0-9\.]+\|\*\|[0-9\.]+\|\*\|/"; sid:1000000;)
|