|
|
|||
| Rule General Information |
|---|
| Release Date: | 2022-02-16 | |
| Rule Name: | Scanner Zgrab Detection | |
| Severity: | ||
| CVE ID: | ||
| Rule Protection Details |
|---|
| Description: | Zgrab is a well-known network scanning tool that can perform fast and extensive scans through supported protocols and ports to obtain information about the target system. This rule is used to detect Zgrab scanner traffic characteristics. | |
| Impact: | Attackers use scanners to scan targets, may find vulnerabilities in the target system, resulting in system information leakage, and then attack the system to obtain system permissions. | |
| Affected OS: | Windows, Linux, Others | |
| Reference: | ||
| Solutions |
|---|
| 1. If scanning behavior from an unknown IP address is determined, block the IP address immediately. 2. ensure that the file system permissions of Web servers and applications are set properly, and restrict access to sensitive files and directories. 3. ensure that systems and applications are updated to the latest version and fix known vulnerabilities to reduce the impact on the system. |