ET POLICY [MS-RPRN] Windows Printer Spooler Activity - RpcAddPrinterDriverEx with Possible UNC Path M1
Sourceet/open
CreatedJuly 6, 2021
UpdatedJuly 7, 2021
Classificationmisc-activity
alert tcp any any -> $HOME_NET [139,445] (msg:"ET POLICY [MS-RPRN] Windows Printer Spooler Activity - RpcAddPrinterDriverEx with Possible UNC Path M1"; flow:established,to_server; content:"|00|"; startswith; content:"SMB"; distance:4; within:3; content:"|00 00|"; distance:0; content:"|10 00 00 00|"; distance:1; within:4; content:"|59 00|"; distance:14; within:2; content:"|5c 00|"; content:"|5c|"; distance:0; within:30; classtype:misc-activity; sid:2033247; rev:2; metadata:created_at 2021_07_06, cve 2021_34527, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_07;)
Metadata
created at2021_07_06
cve2021_34527
confidenceHigh
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2021_07_07
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!