SUSP_FScan_Port_Scanner_Output_Jun23

rule SUSP_FScan_Port_Scanner_Output_Jun23 : SCRIPT {
   meta:
      description = "Detects output generated by the command line port scanner FScan"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
      date = "2023-06-15"
      score = 70
      id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
   strings:
      $s1 = "[*] NetInfo:" ascii
      $s2 = ":443 open" ascii
      $s3 = "   [->]"
   condition:
      filesize < 800KB and all of them
}