Skip to content

Commit ba26295

Browse files
authored
Update idps-signature-categories.md
spacing ... andControl .. and Control
1 parent 440b865 commit ba26295

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/firewall/idps-signature-categories.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Azure Firewall IDPS features over 50 categories that can be assigned to individu
2121
|ActiveX|This category is for signatures that protect against attacks against Microsoft ActiveX controls and exploits targeting vulnerabilities in ActiveX controls.|
2222
|Adware-PUP|This category is for signatures to identify software that is used for ad tracking or other types of spyware related activity.|
2323
|Attack Response|This category is for signatures to identify responses indicative of intrusion—examples include but not limited to LMHost file download, presence of certain web banners and the detection of Metasploit Meterpreter kill command. These signatures are designed to catch the results of a successful attack. Things like *id=root*, or error messages that indicate a compromise may have happened.|
24-
|Botcc (Bot Command and Control)|This category is for signatures that are autogenerated from several sources of known and confirmed active botnet and other Command andControl (C2) hosts. This category is updated daily. The category’s primary data source is `Shadowserver.org.`|
24+
|Botcc (Bot Command and Control)|This category is for signatures that are autogenerated from several sources of known and confirmed active botnet and other Command and Control (C2) hosts. This category is updated daily. The category’s primary data source is `Shadowserver.org.`|
2525
|Botcc Port grouped|This category is for signatures like those in the Botcc category but grouped by destination port. Rules grouped by port can offer higher fidelity than rules not grouped by port.|
2626
|Chat|This category is for signatures that identify traffic related to many chat clients such as Internet Relay Chat (IRC). Chat traffic can be indicative of possible check-in activity by threat actors.|
2727
|CIArmy|This category is for signatures that are generated using Collective Intelligence’s IP rules for blocking.|

0 commit comments

Comments
 (0)