Category: Cyber Attack
( 538 Alerts)NF – Georgian keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 37 00 00" in the payload. The presence of this sequence could indicate the use of the Georgian keyboard layout during the RDP session setup.
NF – Czech keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 05 00 00" in the payload. The presence of this sequence could indicate the use of the Czech keyboard layout during the RDP session setup.
NF – Danish keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "06 04 00 00" in the payload. The presence of this sequence could indicate the use of the Danish keyboard layout during the RDP session setup.
NF – English_United_States keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "09 04 00 00" in the payload. The presence of this sequence could indicate the use of the English_United_States keyboard layout during the RDP session setup.
NF – Afrikaans keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 36 00 00" in the payload. The presence of this sequence could indicate the use of the Afrikaans keyboard layout during the RDP session setup.
NF – Chinese_Taiwan keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 04 00 00" in the payload. The presence of this sequence could indicate the use of the Chinese_Taiwan keyboard layout during the RDP session setup.
NF – Croatian keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 1a 00 00" in the payload. The presence of this sequence could indicate the use of the Croatian keyboard layout during the RDP session setup.
SYN Flood Attack
This alert is triggered when detecting a potential SYN Flood attak. In the attack, the attacked server, has been overwhelmed by the flood of SYN requests, eventually reaches its limit for pending connections and cannot accept any new legitimate connection requests from other clients. This results in a denial of service for legitimate users who are unable to connect to the server.
POLICY-OTHER SunRPC Portmap GETPORT request detected
The rule is designed to trigger an alert when it detects a SunRPC Portmap GETPORT request in the network traffic. The specific content pattern in the rule corresponds to the GETPORT request for the SunRPC Portmap service.
POLICY-OTHER SunRPC Portmap GETPORT request detected
The rule is designed to trigger an alert when it detects a SunRPC Portmap GETPORT request in the network traffic. The specific content pattern in the rule corresponds to the GETPORT request for the SunRPC Portmap service.