Signature Detail
Short Name |
TROJAN:SUBSEVEN:SCAN |
|---|---|
Severity |
Low |
Recommended |
No |
Category |
TROJAN |
Keywords |
subseven |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
TROJAN: SubSeven Scan Attempt
This signature detects TCP packets sent to TCP port 27374. This can indicate an attacker attempting to confirm installation of the Trojan SubSeven v2.2 on the system. SubSeven, a remote administration Trojan, allows attackers to access data and gain control over some functions on remote Microsoft Windows systems. This signature can sometimes trigger false-positives when legitimate services are running on port 27374.
Extended Description
SubSeven is a Trojan that allows remote attackers to gain full control over an infected machine.
References