Rule History

alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] [1024:5000,49152:] (msg:"ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncAddPrinterDriver"; flow:established,to_server; content:"|00|"; offset:3; content:"|10 00 00 00|"; distance:1; within:4; content:"|27 00 8e ca 40 99 2f 51 58 4c 88 a9 61 09 8d 68 96 bd|"; distance:14; within:18; classtype:misc-activity; sid:2033255; rev:4; metadata:created_at 2021_07_06, confidence High, signature_severity Informational, updated_at 2021_07_14;)