ET INFO Plaintext SSH Authentication Identified (Encryption set to None)

SID: 2026643Rev: 40 views
History
Sourceet/open
CreatedNovember 21, 2018
UpdatedApril 24, 2023
Classificationmisc-activity
alert tcp $HOME_NET any -> any 22 (msg:"ET INFO Plaintext SSH Authentication Identified (Encryption set to None)"; flow:established,to_server; content:"|00 00 00|"; content:"|00 00 00|"; within:50; content:"|0e|ssh-connection|00 00 00 08|password|00 00 00 00|"; within:31; content:"|00 00 00 00 00 00 00 00 00|"; distance:0; reference:url,hamwan.org/Standards/Network%20Engineering/Authentication/SSH%20Without%20Encryption.html; classtype:misc-activity; sid:2026643; rev:4; metadata:attack_target Client_and_Server, created_at 2018_11_21, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, updated_at 2023_04_24;)

References

urlhamwan.org/Standards/Network%20Engineering/Authentication/SSH%20Without%20Encryption.html

Metadata

attack targetClient_and_Server
created at2018_11_21
deploymentInternal
performance impactLow
confidenceHigh
signature severityInformational
updated at2023_04_24

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!