Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-MISC] File system full"; content: " 13570
| 3a
| "; classtype: system-error; program: NtFrs
| Ntfs; sid:5009275; metadata: created_on 2022_11_22, old_sid 5001191; rev:4;)Field Validations
Loading…
Comments (0)
Loading comments...