(spp_sip) Empty request URI
The rule is designed to trigger an alert when it detects SIP events where the request URI (Uniform Resource Identifier) is empty. The request URI in a SIP message identifies the target of the SIP request, indicating the desired communication session. An empty request URI is abnormal and can indicate a potential security issue or malformed SIP message.
ID Number
0000002
Signature
alert ( msg: "SIP_EVENT_EMPTY_REQUEST_URI"; sid: 2; gid: 140; rev: 1; metadata: rule-type preproc ; classtype:bad-unknown; reference:cve,2007-1306; )
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Can be disabled will trigger many False Positives