The following are SATAN attack signatures:
- 6001—Normal SATAN probe (severity
5, reconnaissance): This is a supersignature that is triggered
when a port sweep pattern produced by the SATAN tool is detected.
This signature is tuned to detect SATAN being run in normal mode.
Other types of attack activity similar to SATAN may also cause
this signature to be generated. This is indicative that a
reconnaissance sweep of your network may be in progress. This may
be the prelude to a more serious attack.
- 6002—Heavy SATAN probe (severity
5, reconnaissance): This is a supersignature that is triggered
when a port sweep pattern produced by the SATAN tool is detected.
This signature is tuned to detect SATAN being run in heavy mode.
Other types of attack activity similar to SATAN may also cause
this signature to be generated. This is indicative that a
reconnaissance sweep of your network may be in progress. This may
be the prelude to a more serious attack.
|
|
