🐾 - 🚨 NBT-NS protocol 🤕 in use - Broadcast query from Windows 🪟 observed

SID: 3300147Rev: 20 views
Sourcepawpatrules
CreatedJuly 20, 2022
UpdatedNovember 13, 2022
Classificationpolicy-violation
alert udp any 137 -> any 137 (msg:"🐾 - 🚨 NBT-NS protocol 🤕 in use - Broadcast query from Windows 🪟 observed"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 43200; content:"|01 10 00 01 00 00 00 00 00 00|"; fast_pattern; content:"|00 20 00 01|"; endswith; reference:url,https://attack.mitre.org/techniques/T1557/001/; reference:url,https://www.thewindowsclub.com/disable-netbios-and-llmnr-protocols-via-gpo; metadata:created_at 2022_07_20, updated_at 2022_11_13; sid:3300147; rev:2; classtype:policy-violation;)

References

urlhttps://attack.mitre.org/techniques/T1557/001/
urlhttps://www.thewindowsclub.com/disable-netbios-and-llmnr-protocols-via-gpo

Metadata

created at2022_07_20
updated at2022_11_13

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!