Fix Ibm-d2b-database-server.yaml

2023-08-07 17:34:20 +03:00 · 2023-08-07 17:34:20 +03:00 · 4861c89ef4
parent b889c0fddb
commit 4861c89ef4
1 changed files with 9 additions and 0 deletions
--- a/network/detection/ibm-d2b-database-server.yaml
+++ b/network/detection/ibm-d2b-database-server.yaml
@ -27,6 +27,7 @@ tcp:
      - "{{Hostname}}"
      - "{{Host}}:50000"

+    matchers-condition: and
    matchers:
      - type: word
        encoding: hex
@ -35,3 +36,11 @@ tcp:
          - "DB2"
          - "SQLJS1D"
        condition: or
+      - type: word
+        words:
+        - denied
+        - Bad request
+        - HTTP
+        - 400
+        condition: or
+        negative: true