Rule History

SID: 2033261 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 3 • Jul 6, 2021, 12:00 PM

Message:

ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncUploadPrinterDriverPackage

Rule:

alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] [1024:5000,49152:] (msg:"ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncUploadPrinterDriverPackage"; flow:established,to_server; content:"|00|"; offset:3; content:"|10 00 00 00|"; distance:1; within:4; content:"|3f 00 8e ca 40 99 2f 51 58 4c 88 a9 61 09 8d 68 96 bd|"; distance:14; within:18; classtype:misc-activity; sid:2033261; rev:3; metadata:created_at 2021_07_06, confidence High, signature_severity Informational, updated_at 2021_07_20;)

Created:

Jul 6, 2021, 12:00 PM

Updated:

Jul 20, 2021, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-policy.rules