Back to Rule

Rule History

SID: 2067353 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 3Feb 6, 2026, 12:00 PM

ET INFO Samba rsync Sender Mode Session Established

alert tcp any any -> $HOME_NET 873 (msg:"ET INFO Samba rsync Sender Mode Session Established"; flow:established,to_server; flowbits:set,ET.rsync.Sender; flowbits:noalert; content:"@RSYNCD|3a|"; fast_pattern; content:"--server|00|"; content:"--sender|00|"; classtype:misc-activity; sid:2067353; rev:3; metadata:created_at 2026_02_06, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_02_17;)

Feb 6, 2026, 12:00 PM

Feb 17, 2026, 12:00 PM

Feb 6, 2026, 10:34 PM

Feb 17, 2026, 10:34 PM

rules/emerging-info.rules