🐾 - 🚨 Suspicious 👀 NTLM Secure Service Provider setup response from Internet (NTLMSSP Challenge) - Possible Responder 🎩 credentials capturing 🥷 - S0174 - Suricata Rule 3300140 (pawpatrules)

🐾 - 🚨 Suspicious 👀 NTLM Secure Service Provider setup response from Internet (NTLMSSP Challenge) - Possible Responder 🎩 credentials capturing 🥷 - S0174

SID: 3300140Rev: 53 views

Sourcepawpatrules

CreatedAugust 10, 2022

UpdatedFebruary 18, 2024

Classificationcredential-theft

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - 🚨 Suspicious 👀 NTLM Secure Service Provider setup response from Internet (NTLMSSP Challenge) - Possible Responder 🎩 credentials capturing 🥷 - S0174"; flow:to_client, stateless; threshold:type limit, track by_dst,count 1, seconds 60; content:"|4e 54 4c 4d 53 53 50 00|"; fast_pattern; content:"|02 00 00 00|"; reference:url,https://en.wikipedia.org/wiki/NTLMSSP; reference:url,https://g-laurent.blogspot.com/; reference:url,https://github.com/lgandx/Responder; reference:url,https://attack.mitre.org/software/S0174/; target:dest_ip; metadata:created_at 2022_08_10, updated_at 2024_02_18; sid:3300140; rev:5; classtype:credential-theft;)

References

url	https://en.wikipedia.org/wiki/NTLMSSP
url	https://g-laurent.blogspot.com/
url	https://github.com/lgandx/Responder
url	https://attack.mitre.org/software/S0174/

🐾 - 🚨 Suspicious 👀 NTLM Secure Service Provider setup response from Internet (NTLMSSP Challenge) - Possible Responder 🎩 credentials capturing 🥷 - S0174

References

Metadata

Comments (0)