Rule History

alert tcp-pkt any any -> any any (msg: "ATTACK AD [PTsecurity] SPOOLSS Bind"; flow: established, to_server; content: "|78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB|"; flowbits: set, DCERPC.SPOOLSS.Bind; flowbits: noalert; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10006626; rev: 3;)