Versions (4)
Version DetailsCurrent
Rev: 2 • Jul 7, 2021, 12:00 PMET POLICY [MS-RPRN] Windows Printer Spooler Activity - RpcAddPrinterDriverEx with Possible UNC Path M2
alert tcp any any -> $HOME_NET [139,445] (msg:"ET POLICY [MS-RPRN] Windows Printer Spooler Activity - RpcAddPrinterDriverEx with Possible UNC Path M2"; flow:established,to_server; content:"|00|"; startswith; content:"SMB"; distance:4; within:3; content:"|00 00|"; distance:0; content:"|10 00 00 00|"; distance:1; within:4; content:"|59 00|"; distance:14; within:2; content:"|2f 00|"; content:"|2f|"; distance:0; within:30; classtype:misc-activity; sid:2033274; rev:2; metadata:created_at 2021_07_07, cve 2021_34527, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_07;)
Jul 7, 2021, 12:00 PM
Jul 7, 2021, 12:00 PM
Sep 21, 2024, 3:00 AM
Sep 10, 2025, 9:34 PM
rules/emerging-policy.rules