""ET POLICY Suspicious FTP 220 Banner on Local Port (-)""

SID: 2003055

Revision: 14

Class Type: non-standard-protocol

Metadata: created_at 2010_07_30, updated_at 2021_12_16

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: ![21,25,119,139,445,465,587,902,1431]

Destination Network: any

Destination Port: any

Flow: from_server,established, only_stream

Contents:

• Value: "220-" Depth: 4

Within:

PCRE:

Special Options:

source