topic 3340/0 false positives in Network Security

3340/0 false positives

mhellman — Sun, 10 Mar 2019 10:09:32 GMT

This signature triggers on =shell: anywhere in the tcp stream.

Isn't there a way to tighten this up? If fires even when I got to the Cisco MySDN page for this signature (because it has the word =shell: in the html returned).

Re: 3340/0 false positives

jlimbo — Thu, 10 Aug 2006 00:49:09 GMT

Hi,

Thanks for bringing this to our attention, we will have a closer look at this signature to see where it can be improved.

Is it the mainpage of MySDN that causes the FP? If it is something more specific, would you be able to provide the URL please?

Thanks,

Jonathan

Re: 3340/0 false positives

mhellman — Thu, 10 Aug 2006 01:22:05 GMT

I believe it triggered on this URL:

http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=3340&signatureSubId=0