Signature Detail
Short Name |
CHAT:IRC:NICK |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
CHAT |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
IRC: Access
This signature detects IRC chat that is using the "nick" command. IRC chat users communicate using a "nick," which is a chosen nickname. Additionally, compromised machines can join an IRC "botnet," an IRC channel under control of a malicious hacker. IRC traffic from systems not normally allowed to connect to IRC channels (such as infrastructure servers) can indicate this has occurred. Users can change the port range on the signature to check for IRC traffic across all ports. Note: this can impact the IDP performance.
Extended Description
None
References