""ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Enumeration Activity M1""

SID: 2034864

Revision: 1

Class Type: attempted-recon

Metadata: created_at 2022_01_10, updated_at 2022_01_10

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_server

Contents:

• Value: "GET"

• Value: "host="

• Value: "port="

• Value: "request=|22|GET"

• Value: "whoami"

Within:

PCRE:

Special Options:

• http_method

• http_uri

• http_uri

• http_uri

• http_uri

• fast_pattern

source