medium10 pts · first answer countssuricatanetwork-security

Read a Suricata rule

What does this Suricata rule alert on?

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious PowerShell UA"; http.user_agent; content:"WindowsPowerShell"; nocase; sid:1000001; rev:1;)

A.Any inbound HTTP request from the internet to a web serverB.PowerShell scripts saved to disk on internal hostsC.Outbound HTTP requests from internal hosts whose User-Agent contains "WindowsPowerShell"D.DNS lookups for domains containing the word PowerShell

Discussion 0

Join free to post in the discussion.

Read a Suricata rule

Discussion 0

Related questions