Versions (3)
Version DetailsCurrent
Rev: 4 • Mar 30, 2022, 12:00 PMStamus Networks MS-NRPC service - DsrGetDcNameEx2
alert smb any any -> $HOME_NET any (msg:"Stamus Networks MS-NRPC service - DsrGetDcNameEx2"; flow:to_server, established; dcerpc.iface:12345678-1234-ABCD-EF00-01234567CFFB; dcerpc.opnum:34; flowbits:set,stamus.nrpc.service.DsrGetDcNameEx2; metadata:lateral_key dcerpc.iface, lateral_function DsrGetDcNameEx2, lateral_asset src_ip, stamus_classification lateral, provider Stamus, created_at 2022_03_30, updated_at 2024_08_05, source smb_lateral, signature_severity Informational; target:dest_ip; sid:3115204; rev:4; reference:url,https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/25667880-3d51-499b-b228-19c08eb16b81; reference:url,https://www.stamus-networks.com/blog/new-open-ruleset-for-detecting-lateral-movement-with-suricata; reference:url,https://www.stamus-networks.com/blog/threat-hunting-with-the-open-lateral-movement-ruleset-for-suricata;)
Mar 30, 2022, 12:00 PM
Aug 5, 2024, 12:00 PM
Nov 14, 2022, 9:22 PM
May 29, 2025, 11:31 PM
rules/stamus-lateral.rules