Rule History

SID: 10004152 • Source: ptrules/open

Versions (6)

Version DetailsCurrent

Rev: 1 • Jun 24, 2025, 4:00 PM

Message:

ATTACK AD [PTsecurity] SPOOLSS DCERPC/SMB Bind

Rule:

alert smb any any -> any any (msg:"ATTACK AD [PTsecurity] SPOOLSS DCERPC/SMB Bind"; flow:to_server, established, no_stream; content:"SMB"; offset:5; depth:3; content:"|05 00 0B|"; distance:0; content:"|78 56 34 12 34 12 cd ab ef 00 01 23 45 67 89 ab 01 00 00 00|"; distance:29; flowbits:set, DCERPC.BIND.SPOOLSS; flowbits:noalert; reference:url, rules.ptsecurity.com; classtype:attempted-recon; sid:10004152; rev:1;)

Created:

Jun 24, 2025, 4:00 PM

Updated:

Jun 24, 2025, 4:00 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-windows.rules