alert smb any any -> $HOME_NET any (msg:"ET INFO Quest KACE Desktop Authority Server SMB Named Pipe Create"; flow:established,to_server; flowbits:set,ET.QuestKACE.SMB; flowbits:noalert; content:"SMB"; depth:8; content:"S|00|c|00|r|00|i|00|p|00|t|00|L|00|o|00|g|00|i|00|c|00|_|00|S|00|e|00|r|00|v|00|e|00|r|00|_|00|N|00|a|00|m|00|e|00|d|00|P|00|i|00|p|00|e|00|_|00|9|00|3|00|0|00|0|00|"; fast_pattern; reference:url,www.netspi.com/blog/technical-blog/adversary-simulation/pipe-dreams-remote-code-execution-via-quest-desktop-authority-named-pipe/; classtype:misc-activity; sid:2067416; rev:1; metadata:attack_target Server, created_at 2026_02_09, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_02_09; target:dest_ip;)