Intrusion PreventionPulse.Secure.UNC2630.Backdoor
Description
This indicates that C2 communication to threat actor UNC2630-associated backdoors in Pulse Secure was detected in the network.
Affected Products
Pulse Connect Secure products
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
This signature's action can be set to "Block" to block this application.
Please use Anti-Virus software to scan and clean the system.
Also follow the latest advisory from the vendor.
https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44755/
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 50221 |
| Created | Apr 21, 2021 |
| Updated | Aug 08, 2022 |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | Other |
| Affected App | CGI_app, Other |