ET SCAN UPnP SUBSCRIBE Inbound - Possible CallStranger Scan (CVE-2020-12695) - Suricata Rule 2030272 (et/open)

ET SCAN UPnP SUBSCRIBE Inbound - Possible CallStranger Scan (CVE-2020-12695)

SID: 2030272Rev: 21 viewsHistory

Sourceet/open

CreatedJune 9, 2020

UpdatedJune 9, 2020

Classificationattempted-recon

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN UPnP SUBSCRIBE Inbound - Possible CallStranger Scan (CVE-2020-12695)"; flow:established,to_server; http.method; content:"SUBSCRIBE"; nocase; http.header; content:"CALLBACK|3a 20|"; fast_pattern; content:"NT|3a 20|"; reference:cve,2020-12695; reference:url,kb.cert.org/vuls/id/339275; classtype:attempted-recon; sid:2030272; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_06_09, cve CVE_2020_12695, deployment Perimeter, confidence Medium, signature_severity Informational, updated_at 2020_06_09;)

References

cve	2020-12695
url	kb.cert.org/vuls/id/339275

Metadata

attack targetClient_Endpoint

created at2020_06_09

cveCVE-2020-12695

deploymentPerimeter

confidenceMedium

signature severityInformational

updated at2020_06_09

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!