Cisco Webdialer Ssrf Attempt Udm Context
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
YARA-L
