NF – Generic – DNS Response 127.0.0.1 – Possible sinkholed domain – Check domain
The rule detects DNS responses containing the IP address 127.0.0.1. This rule is used to identify possible sinkholed domains, where malicious domains are intentionally resolved to the loopback address (127.0.0.1) to prevent further communication with malicious servers.
Basic Auth Base64 HTTP Password detected unencrypted
The rule detects instances of unencrypted Basic Authentication (Base64-encoded) HTTP passwords being transmitted over the network. Basic Authentication is a simple method for sending credentials (username and password) over HTTP.
NF – ISAKMP VPN Connection setup from host to outbound destination – Windows XP
The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 03). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows XP hosts, and assist in monitoring and securing VPN communication in the network.
NF – EXPLOIT [PTsecurity] DoublePulsar Backdoor installation communication
The rule detects communication related to the installation of the DoublePulsar Backdoor, specifically looking for specific patterns and headers in the TCP payload. The DoublePulsar Backdoor is associated with the EternalBlue exploit and is a significant security threat that could lead to unauthorized access and control of vulnerable systems.
NF – ISAKMP VPN Connection setup from host to outbound destination – Windows Vista
The rule detects ISAKMP VPN connection setups originating from the internal network to an outbound destination (EXTERNAL_NET), with a specific ISAKMP Initiator cookie value (00 00 00 05). The rule is intended to provide visibility into ISAKMP VPN connection attempts, particularly those related to Windows Vista hosts, and assist in monitoring and securing VPN communication in the network.