""GPL SCAN ssh-research-scanner""

SID: 2100617

Revision: 6

Class Type: attempted-recon

Metadata: created_at 2010_09_23, updated_at 2012_08_01

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: 22

Flow: to_server,established

Contents:

• Value: "|00 00 00|`|00 00 00 00 00 00 00 00 01 00 00 00|"

Within:

PCRE:

Special Options:

source