alert smb any any -> any any (msg:"ATTACK AD [PTsecurity] SPOOLSS DCERPC/SMB Bind"; flow:to_server, established, no_stream; content:"SMB"; offset:5; depth:3; content:"|05 00 0B|"; distance:0; content:"|78 56 34 12 34 12 cd ab ef 00 01 23 45 67 89 ab 01 00 00 00|"; distance:29; flowbits:set, DCERPC.BIND.SPOOLSS; flowbits:noalert; reference:url, github.com/ptresearch/AttackDetection; classtype:attempted-recon; sid:10004152; rev:1;)