ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncInstallPrinterDriverFromPackage
Sourceet/open
CreatedJuly 6, 2021
UpdatedJuly 20, 2021
Classificationmisc-activity
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] [1024:5000,49152:] (msg:"ET POLICY [MS-PAR] Windows Printer Spooler Activity - RpcAsyncInstallPrinterDriverFromPackage"; flow:established,to_server; content:"|00|"; offset:3; content:"|10 00 00 00|"; distance:1; within:4; content:"|3e 00 8e ca 40 99 2f 51 58 4c 88 a9 61 09 8d 68 96 bd|"; distance:14; within:18; classtype:misc-activity; sid:2033260; rev:3; metadata:created_at 2021_07_06, confidence High, signature_severity Informational, updated_at 2021_07_20;)
Metadata
created at2021_07_06
confidenceHigh
signature severityInformational
updated at2021_07_20
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!