Rule History

SID: 2022291 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 1 • Dec 21, 2015, 12:00 PM

Message:

ET EXPLOIT Juniper ScreenOS telnet Backdoor Default Password Attempt

Rule:

alert tcp any any -> $HOME_NET 23 (msg:"ET EXPLOIT Juniper ScreenOS telnet Backdoor Default Password Attempt"; flow:established,to_server; content:"|3c 3c 3c 20 25 73 28 75 6e 3d 27 25 73 27 29 20 3d 20 25 75|"; fast_pattern; threshold:type limit, count 1, seconds 60, track by_src; reference:cve,2015-7755; reference:url,community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor; classtype:attempted-admin; sid:2022291; rev:1; metadata:created_at 2015_12_21, cve CVE_2015_7755, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)

Created:

Dec 21, 2015, 12:00 PM

Updated:

Jul 26, 2019, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Jan 19, 2026, 10:35 PM

Filename:

rules/emerging-exploit.rules