Szczególy klastra: SMB connection request, 92.60.130.* IP prefix (445/TCP)

Nazwa:	SMB connection request, 92.60.130.* IP prefix (445/TCP)
Data:	2012-03-20 08:30:08
Poziom klasyfikacji:	Attack
Rdzeń:	SMB connection request, 92.60.130.* IP prefix (445/TCP)
Porty:	445/TCP
Unikalnych źródeł:	29
Rozmiar sygnatury:	72
Sygnatura klastra:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB connection request, "; pcre:"/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.?\b/"; content:".* IP prefix (44\ 5/TCP)"; flow:to_server,established; content:"|00 00 00|Z|ff|SMBu|00 00 00 00 18 07 c8 00 00 00 00 0\ 0 00 00 00 00 00 00 00 00 00 ff fe 00 08|0|00 04 ff 00|\\|00 08 00 01 00|/|00 00|\\|00|\\|00|9|00|2|\ 00|.|00|6|00|0|00|.|00|1|00|3|00|0|00|.|00|";)