Versions (6)
Version DetailsCurrent
Rev: 3 • Jun 24, 2025, 4:00 PMATTACK AD [PTsecurity] Remote WMI Win32_Process create
alert tcp any any -> any any (msg:"ATTACK AD [PTsecurity] Remote WMI Win32_Process create"; flow:established, to_server; content:"|05 00 00|"; depth:3; content:"W|00|i|00|n|00|3|00|2|00|_|00|P|00|r|00|o|00|c|00|e|00|s|00|s|00 00 00|"; fast_pattern; content:"c|00|r|00|e|00|a|00|t|00|e|00|"; distance:16; within:12; nocase; flowbits:set, WMI.Win32_Process.Create; threshold:type limit, track by_src, count 1, seconds 10; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10001999; rev:3;)
Jun 24, 2025, 4:00 PM
Jun 24, 2025, 4:00 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-windows.rules