""ET SCAN Potential FTP Brute-Force attempt response""
SID: 2002383
Revision: 12
Class Type: unsuccessful-user
Metadata: created_at 2010_07_30, updated_at 2015_04_15
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: 21
Destination Network: $EXTERNAL_NET
Destination Port: any
Flow: from_server,established
Contents:
- Value: "530 " Depth: 4
Within:
PCRE: "/530\s+(Login|User|Failed|Not)/smi"
Special Options: