Rule History

alert smb $HOME_NET any -> $HOME_NET 445 (msg: "SPYWARE [PTsecurity] Buhtrap FB set Pegasus.arch_probe"; flow: established, to_server, no_stream; content: "SMB"; content: "|05 00|"; distance: 8; within: 2; content: "n|00|o|00|t|00|e|00|p|00|a|00|d|00|.|00|e|00|x|00|e|00|"; nocase; distance: 96; flowbits: noalert; flowbits: isset, SMB.TreeConnect.ADMIN; flowbits: set, Pegasus.arch_probe; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10003308; rev: 4;)