🐾 - 🚨 Suspicious WinSCP 📂 SSH/SFTP connection to Internet 🌐 - 👀 used including by Lockbit ransomware group 👿 - Suricata Rule 3300126 (pawpatrules)

🐾 - 🚨 Suspicious WinSCP 📂 SSH/SFTP connection to Internet 🌐 - 👀 used including by Lockbit ransomware group 👿

SID: 3300126Rev: 11 views

Sourcepawpatrules

CreatedJuly 9, 2023

UpdatedJuly 9, 2023

Classificationpolicy-violation

alert ssh any any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious WinSCP 📂 SSH/SFTP connection to Internet 🌐 - 👀 used including by Lockbit ransomware group 👿"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 3600; ssh.software; content:"WinSCP_"; fast_pattern; nocase; reference:url,https://winscp.net/; reference:url,https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a; metadata:created_at 2023_07_09, updated_at 2023_07_09; sid:3300126; rev:1; classtype:policy-violation;)

References

url	https://winscp.net/
url	https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

🐾 - 🚨 Suspicious WinSCP 📂 SSH/SFTP connection to Internet 🌐 - 👀 used including by Lockbit ransomware group 👿

References

Metadata

Comments (0)