SCAN: Telnet Command "id"

This signature detects the TELNET command "id." An attacker can verify their privilege level on a compromised machine by submitting the "id" command. Knowing the privilege level allows them to determine what action they can perform with the compromised machine; for example, create a denial-of-service condition or execute arbitrary code. Receiving several hits for this signature should alert the user that their system might be compromised.

Short Name

SCAN:MISC:TELNET:ID

Severity

Info

Recommended

False

Recommended Action

None

SCAN: Telnet Command "id"

Found a potential security threat?