diff options
Diffstat (limited to 'test/results/flow-info/default/log4j-webapp-exploit.pcap.out')
1 files changed, 4 insertions, 4 deletions
diff --git a/test/results/flow-info/default/log4j-webapp-exploit.pcap.out b/test/results/flow-info/default/log4j-webapp-exploit.pcap.out index b3c0e97f3..b1e2a24c5 100644 --- a/test/results/flow-info/default/log4j-webapp-exploit.pcap.out +++ b/test/results/flow-info/default/log4j-webapp-exploit.pcap.out @@ -37,18 +37,18 @@ detection-update: [.....6] [ip4][..tcp] [..172.16.238.10][48534] -> [..172.16.238.11][...80] [HTTP][Unknown][Download][Acceptable][172.16.238.11] RISK: Binary App Transfer, HTTP/TLS/QUIC Numeric Hostname/SNI, Possible Exploit Attempt new: [.....7] [ip4][..tcp] [..172.16.238.10][55498] -> [....10.10.10.31][.9001] + end: [.....2] [ip4][..tcp] [..172.16.238.10][57650] -> [..172.16.238.11][.1389] [LDAP][Unknown][System][Acceptable] + RISK: Known Proto on Non Std Port end: [.....5] [ip4][..tcp] [..172.16.238.10][57742] -> [..172.16.238.11][.1389] [LDAP][Unknown][System][Acceptable] RISK: Known Proto on Non Std Port - idle: [.....1] [ip4][..tcp] [...172.16.238.1][.1984] -> [..172.16.238.10][.8080] [HTTP][Unknown][Web][Acceptable][192.168.13.31] - RISK: Known Proto on Non Std Port, HTTP/TLS/QUIC Numeric Hostname/SNI, HTTP Susp Header, Possible Exploit Attempt end: [.....4] [ip4][..tcp] [..172.16.238.10][55408] -> [....10.10.10.31][.9001] [Unknown][Unknown][Unrated] not-detected: [.....7] [ip4][..tcp] [..172.16.238.10][55498] -> [....10.10.10.31][.9001] [Unknown][Unknown][Unrated] RISK: TCP Connection Issues end: [.....7] [ip4][..tcp] [..172.16.238.10][55498] -> [....10.10.10.31][.9001] + idle: [.....1] [ip4][..tcp] [...172.16.238.1][.1984] -> [..172.16.238.10][.8080] [HTTP][Unknown][Web][Acceptable][192.168.13.31] + RISK: Known Proto on Non Std Port, HTTP/TLS/QUIC Numeric Hostname/SNI, HTTP Susp Header, Possible Exploit Attempt end: [.....3] [ip4][..tcp] [..172.16.238.10][48444] -> [..172.16.238.11][...80] [HTTP][Unknown][Download][Acceptable][172.16.238.11] RISK: Binary App Transfer, HTTP/TLS/QUIC Numeric Hostname/SNI, Possible Exploit Attempt end: [.....6] [ip4][..tcp] [..172.16.238.10][48534] -> [..172.16.238.11][...80] [HTTP][Unknown][Download][Acceptable][172.16.238.11] RISK: Binary App Transfer, HTTP/TLS/QUIC Numeric Hostname/SNI, Possible Exploit Attempt - end: [.....2] [ip4][..tcp] [..172.16.238.10][57650] -> [..172.16.238.11][.1389] [LDAP][Unknown][System][Acceptable] - RISK: Known Proto on Non Std Port DAEMON-EVENT: shutdown |