Versions (7)
Version DetailsCurrent
Rev: 3 • Jun 24, 2025, 4:00 PMATTACK AD [PTsecurity] HTTP-to-SMB NTLM Relay attack (SMBv2)
alert smb any any -> any any (msg:"ATTACK AD [PTsecurity] HTTP-to-SMB NTLM Relay attack (SMBv2)"; flow:established, to_server; content:"|FE|SMB"; content:"|01 00|"; distance:8; within:2; content:"NTLMSSP|00 03 00 00 00|"; distance:0; content:"|09 00|"; distance:0; within:600; content:"H|00|T|00|T|00|P|00 2F|"; distance:2; within:9; isdataat:200, relative; reference:url, byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10005231; rev:3;)
Jun 24, 2025, 4:00 PM
Jun 24, 2025, 4:00 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-windows.rules