Versions (2)
Version DetailsCurrent
Rev: 1 • Dec 29, 2025, 12:00 PMET INFO MongoDB SASL Authentication Detected
alert tcp any any -> $HOME_NET 27017 (msg:"ET INFO MongoDB SASL Authentication Detected"; flow:established,to_server; flowbits:set,ET.MongoDB_Auth_Attempt; flowbits:noalert; content:"|dd 07 00 00|"; offset:12; depth:4; content:"saslstart"; fast_pattern; nocase; distance:0; reference:url,www.alienfactory.co.uk/articles/mongodb-scramsha1-over-sasl; classtype:misc-activity; sid:2066500; rev:1; metadata:affected_product MongoDB, attack_target Server, created_at 2025_12_29, deployment Perimeter, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_12_29; target:dest_ip;)
Dec 29, 2025, 12:00 PM
Dec 29, 2025, 12:00 PM
Dec 29, 2025, 9:34 PM
Dec 30, 2025, 9:34 PM
rules/emerging-info.rules