🐾 - 🔔 DCERPC - Operating System request to 🪟 - Possible System Information Discovery 🥷 - T1082 - Suricata Rule 3300333 (pawpatrules)

🐾 - 🔔 DCERPC - Operating System request to 🪟 - Possible System Information Discovery 🥷 - T1082

SID: 3300333Rev: 24 views

Sourcepawpatrules

CreatedJuly 30, 2023

UpdatedJuly 30, 2023

Classificationattempted-recon

alert tcp-pkt any any -> $HOME_NET any (msg:"🐾 - 🔔 DCERPC - Operating System request to 🪟 - Possible System Information Discovery 🥷 - T1082"; flow:to_server, stateless; content:"|05 00 00 83|"; content:"|5f 5f 50 41 52 41 4d 45 54 45 52 53 00 00 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 00 00|"; fast_pattern; reference:url,https://attack.mitre.org/techniques/T1082/; reference:url,https://github.com/GhostPack/Seatbelt#remote-enumeration; metadata:created_at 2023_07_30, updated_at 2023_07_30; sid:3300333; rev:2; classtype:attempted-recon;)

References

url	https://attack.mitre.org/techniques/T1082/
url	https://github.com/GhostPack/Seatbelt#remote-enumeration

🐾 - 🔔 DCERPC - Operating System request to 🪟 - Possible System Information Discovery 🥷 - T1082

References

Metadata

Comments (0)