""ET SCAN Non-Allowed Host Tried to Connect to MySQL Server""

SID: 2010493

Revision: 2

Class Type: attempted-recon

Metadata: created_at 2010_07_30, updated_at 2010_07_30

Reference:

• Link

Protocol: tcp

Source Network: $HOME_NET

Source Port: 3306

Destination Network: any

Destination Port: any

Flow: from_server,established

Contents:

• Value: "|6A 04|Host|20 27|" Depth: 70

• Value: "|27 20|is not allowed to connect to this MySQL server"

Within:

PCRE:

Special Options:

source