alert tcp-pkt any any -> any any (msg:"ATTACK [PTsecurity] SPOOLSS Bind"; flow:established, to_server; content:"|78 56 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB|"; flowbits:set, DCERPC.SPOOLSS.Bind; flowbits:noalert; reference:url, github.com/ptresearch/AttackDetection; metadata:Open Ptsecurity.com ruleset; metadata:created_at 2021_07_12, updated_at 2021_08_10; classtype:attempted-admin; sid:10006626; rev:3;)