""GPL SQL sa login failed""

SID: 2100680

Revision: 10

Class Type: attempted-user

Metadata: created_at 2010_09_23, cve CVE_2000_1209, updated_at 2012_09_12

Reference:

  • cve

  • 2000-1209

Protocol: tcp

Source Network: $SQL_SERVERS

Source Port: 139

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "Login failed for user 'sa'"

Offset: 83

Within:

PCRE:

Special Options:

source