🐾 - 🚨 NBT-NS query response observed 👀 - Possible Poisoning Attack 🥷 to Windows 🪟 - T1557.001

SID: 3300146Rev: 40 views
Sourcepawpatrules
CreatedJuly 20, 2022
UpdatedDecember 21, 2022
Classificationpolicy-violation
alert udp any 137 -> any 137 (msg:"🐾 - 🚨 NBT-NS query response observed 👀 - Possible Poisoning Attack 🥷 to Windows 🪟 - T1557.001"; flow:stateless; content:"|85 00 00 00 00 01 00 00 00 00|"; fast_pattern; content:"|00 20 00 01|"; reference:url,https://attack.mitre.org/techniques/T1557/001/; reference:url,https://www.thewindowsclub.com/disable-netbios-and-llmnr-protocols-via-gpo; metadata:created_at 2022_07_20, updated_at 2022_12_21; sid:3300146; rev:4; classtype:policy-violation;)

References

urlhttps://attack.mitre.org/techniques/T1557/001/
urlhttps://www.thewindowsclub.com/disable-netbios-and-llmnr-protocols-via-gpo

Metadata

created at2022_07_20
updated at2022_12_21

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!