GIAC
GCED · Question #42
The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?
The correct answer is C. alert tcp any 23 <> any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;). You've hit your limit · resets 1pm (America/New_York)
Perimeter Security and Intrusion Detection
Question
The security team wants to detect connections that can compromise credentials by sending them in plaintext across the wire. Which of the following rules should they enable on their IDS sensor?
Options
- Aalert tcp any 22 <> any 22 (msg:SSH connection; class type:misc-attack;sid: 122:rev:1;)
- Balert tcp any any <> any 6000: (msg:X-Windows session;
- Calert tcp any 23 <> any 23 (msg:Telnet shell; class type:misc-attack;sid:100; rev:1;)
- Dalert udp any any <> any 5060 (msg:VOIP message; classtype:misc-attack;sid:113; rev:2;)
How the community answered
(60 responses)- A5% (3)
- B8% (5)
- C72% (43)
- D15% (9)
Explanation
You've hit your limit · resets 1pm (America/New_York)
Topics
#IDS rules#Telnet#plaintext credentials#Snort signatures
Community Discussion
No community discussion yet for this question.