Inetutils Telnetd Authentication Bypass Exploitation Attempt
This rule detects exploitation attempts targeting Inetutils Telnetd's authentication bypass vulnerability. It specifically looks for patterns in network data during Telnet negotiation (destination port 23, TELNET protocol) that indicate an attempt to inject '-f' into the USER environment variable. This can occur either directly during Telnet negotiation or through a combination of IAC (Interpret As Command) negotiation for environment variables and subsequent USER variable injection with the '-f' flag, potentially alongside specific terminal configurations like 'XTERM-256COLOR' or 'screen-256color' and common baud rates.
Sigma
