Rule History

SID: 10012800 • Source: ptrules/open

Versions (4)

Version DetailsCurrent

Rev: 2 • Jun 24, 2025, 4:00 PM

Message:

ATTACK AD [PTsecurity] Krbrelayx Malicious DNS Resolve to Kerberos Relay

Rule:

alert udp any any -> any 5355 (msg: "ATTACK AD [PTsecurity] Krbrelayx Malicious DNS Resolve to Kerberos Relay"; flow: to_server; content: "1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; nocase; content: "YBAAAA"; distance: 0; nocase; reference: url, https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10012800; rev: 2;)

Created:

Jun 24, 2025, 4:00 PM

Updated:

Jun 24, 2025, 4:00 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-windows.rules