ATTACK AD [PTsecurity] Remote WMI Win32_Process create

SID: 10001999Rev: 314 views
History
Sourceptrules/open
CreatedJune 24, 2025
UpdatedJune 24, 2025
Classificationattempted-admin
alert tcp any any -> any any (msg:"ATTACK AD [PTsecurity] Remote WMI Win32_Process create"; flow:established, to_server; content:"|05 00 00|"; depth:3; content:"W|00|i|00|n|00|3|00|2|00|_|00|P|00|r|00|o|00|c|00|e|00|s|00|s|00 00 00|"; fast_pattern; content:"c|00|r|00|e|00|a|00|t|00|e|00|"; distance:16; within:12; nocase; flowbits:set, WMI.Win32_Process.Create; threshold:type limit, track by_src, count 1, seconds 10; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10001999; rev:3;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!