Rule History

SID: 2048645 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Oct 18, 2023, 12:00 PM

Message:

ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Dropbear SSH Banner - Possible SSH Login attempt

Rule:

alert ssh $HOME_NET any -> any any (msg:"ET SCADA [nsacyber/ELITEWOLF] Schweitzer Engineering Laboratories SEL-series Dropbear SSH Banner - Possible SSH Login attempt"; flow:established,to_client; content:"SSH-2.0-dropbear_2016.74"; fast_pattern; threshold:type limit, track by_dst, seconds 500, count 1; reference:url,github.com/nsacyber/ELITEWOLF; classtype:suspicious-login; sid:2048645; rev:1; metadata:affected_product Schweitzer_Engineering_Laboratories_SEL_Series, attack_target ICS, created_at 2023_10_18, deployment Perimeter, deployment Internal, performance_impact Low, confidence Low, signature_severity Minor, updated_at 2023_10_18, reviewed_at 2023_10_18; target:src_ip;)

Created:

Oct 18, 2023, 12:00 PM

Updated:

Oct 18, 2023, 12:00 PM

DB Created:

Oct 18, 2023, 10:00 PM

DB Updated:

Oct 18, 2023, 10:00 PM

Filename:

rules/emerging-scada.rules