Rule History

alert tcp $HOME_NET any -> any 22 (msg:"ET INFO Plaintext SSH Authentication Identified (Encryption set to None)"; flow:established,to_server; content:"|00 00 00|"; content:"|00 00 00|"; within:50; content:"|0e|ssh-connection|00 00 00 08|password|00 00 00 00|"; within:31; content:"|00 00 00 00 00 00 00 00 00|"; distance:0; reference:url,hamwan.org/Standards/Network%20Engineering/Authentication/SSH%20Without%20Encryption.html; classtype:misc-activity; sid:2026643; rev:4; metadata:attack_target Client_and_Server, created_at 2018_11_21, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_04_24;)