Host is trying to connect to VShell server but exists in the deny file.

Description

Host is trying to connect to VShell server but exists in the deny file.

Query · wazuh

regex="Connection from (\d+.\d+.\d+.\d+) rejected by Deny Hosts file"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 86800 VShell message grouped. anchor level 0
    decoded_as=windows-date-format AND match="VShellSSH2"
  2. 86804 Host is trying to connect to VShell server but exists in the deny file. refinement level 10 this rule
    regex="Connection from (\d+.\d+.\d+.\d+) rejected by Deny Hosts file"

Rule dependencies

Depends on

Raw source Host is trying to connect to VShell server but exists in the deny file. · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="86804" level="10">
    <if_sid>86800</if_sid>
    <regex>Connection from (\d+.\d+.\d+.\d+) rejected by Deny Hosts file</regex>
    <description>Host is trying to connect to VShell server but exists in the deny file.</description>
    <group>gdpr_IV_35.7.d,</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.