security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update MySQL port to 3306 not 3336 (#2)

Browse Source
This commit is contained in:
Erkin Djindjiev
2020-07-01 11:52:04 -04:00
committed by GitHub
parent e48a987ce4
commit 1fac018f10
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/network/command_and_control_sql_server_port_activity_to_the_internet.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
ecs_version = ["1.4.0"]
maturity = "production"
updated_date = "2020/03/09"
updated_date = "2020/07/01"
[rule]
author = ["Elastic"]
@@ -30,7 +30,7 @@ tags = ["Elastic", "Network"]
type = "query"
query = '''
network.transport:tcp and destination.port:(1433 or 1521 or 3336 or 5432) and
network.transport:tcp and destination.port:(1433 or 1521 or 3306 or 5432) and
source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and
not destination.ip:(10.0.0.0/8 or 127.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "::1")
'''