alert tcp-pkt any any -> any any (msg:"ATTACK [PTsecurity] EFSR Bind"; flow:established, to_server; content:"|05 00 0B|"; content:"|88 D4 81 C6 50 D8 D0 11 8C 52 00 C0 4F D9 0F 7E|"; within:64; flowbits:set, DCERPC.EFSR.Bind; reference:url, github.com/ptresearch/AttackDetection; metadata:Open Ptsecurity.com ruleset; metadata:created_at 2021_07_23, updated_at 2021_11_19; classtype:attempted-admin; sid:10006662; rev:2;)