Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 Administration Manual page 266

258 E T
NTERPRISE EMPLATE
Table B-9 Default Rules (continued)
Rule
Default-Rule-Exploit:
Attacker Vulnerable to
this Exploit
Default-Rule-Exploit:
Exploit Followed by
Suspicious Host Activity
Default-Rule-Exploit:
Exploit/Malware Events
Across Multiple Targets
Default-Rule-Exploit:
Exploits Events with
High Magnitude
Become Offenses
Default-Rule-Exploit:
Multiple Exploit Types
Against Single target
Default-Rule-Exploit:
Potential VoIP Toll
Fraud
Default-Rule-Exploit:
Recon followed by
Exploit
Default-Rule-Exploit:
Target Vulnerable to
Detected Exploit
Default-Rule-Exploit:
Target Vulnerable to
Detected Exploit on a
Different Port
Default-Rule-Exploit:
Target Vulnerable to
Different Exploit than
Attempted on Attacked
Port
D
EFAULTS
Rule
Group Type
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
Exploit Event
STRM Administration Guide
Enabled Description
False Reports an attack from a local host where the
attacker is vulnerable to the attack being used. It
is possible that the attacker was a target in an
earlier offense.
False Reports an exploit or attack type activity from a
source IP address followed by suspicious
account activity on the destination host within 15
minutes.
True Reports a source IP address generating multiple
(at least 5) exploits or malicious software
(malware) events in the last 5 minutes. These
events are not targeting hosts that are
vulnerable and may indicate false positives
generating from a device.
True Rule forces the creation of offenses for
exploit-based events with a high magnitude.
True Reports a target attempting to be exploited using
multiple types of attacks from one or more
attackers.
False Reports multiple failed logins to your VoIP
hardware followed by sessions being opened. At
least 3 events were detected within 30 seconds.
This action could indicate that illegal users are
executing VoIP sessions on your network.
True Reports reconnaissance followed by an exploit
from the same source IP address to the same
destination port within 1 hour.
True Reports an attack against a vulnerable local
target, where the target is known to exist, and
the host is vulnerable to the attack.
True Reports an attack against a vulnerable local
target, where the target is known to exist, and
the host is vulnerable to the attack on a different
port.
False Reports an attack against a vulnerable local
target, where the target is known to exist, and
the host is vulnerable to some attack but not the
one being attempted.