Re: [Prelude Hybrid IDS] #245: New LML-Ruleset for Kojoney SSH Honeypot - please review
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#245: New LML-Ruleset for Kojoney SSH Honeypot - please review
-------------------------+--------------------------------------------------
Reporter: bjou | Owner: yoann
Type: defect | Status: new
Priority: normal | Milestone:
Component: prelude-lml | Version: 0.9
Severity: trivial | Resolution:
Keywords: |
-------------------------+--------------------------------------------------
Comment (by bjou):
* No Ipv6 here, either
* The Login may be set within the mentioned field, as I said, currently I
cannot test it as our systems are down. If you feel this would be the
right place to put it, why not... I dont know where it would appear in
Prelude though
* Command line spelling can be changed
* Command should be assigned to which IDMEF field?
* There is a reason why i dont assign the saved filename, as it is
getting obfuscated and does not relly look nice. One could think about it,
though. Looks like ''http___evilserver_xhost_ro_e_tgz300''
* The number in the log messages is some kind of ID, just an continuously
increasing numbver for each connect
--
Ticket URL: <https://trac.prelude-ids.org/ticket/245#comment:2>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel