INDICATOR-SCAN -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. This alert showed because Snort has detected a tool or script attempting to find objects on the network. This could be as simple as pinging a specific port that WordPress admins commonly use to see if a WordPress-targeted attack might succeed, or it could be as complex as attempting to create a map of the entire network, including ports, services, and devices. Snort scans the signature of this attempt to determine if it is different from the allowed network scanning tools (such as NMAP), and is therefore likely an attack.
INDICATOR-SCAN synscan portscan
A host has scanned the network looking for vulnerable servers. Impact: Information leak, reconnaisance, preperation for automated attack such as worm propagation Details: Synscan is the scanning and vulnerability testing engines for ramen, canserserver and is included in some versions of the t0rn root kit as t0rnscan. It is a very fast syn scanner. Ease of Attack: This scanner is fast and easy to use. It is readily available and was included with several worms.
No information provided
No public information
Known false positives, with the described conditions
sscan, mscan, and several other tools used ID=39426 but the use of SYNFIN is unique to synscan [1.5|1.6]
Don Smith Initial Research Josh Gray Edits
No rule groups
None
No information provided
None
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
