Sagan medium stable other

[WINDOWS-SECURITY] Potential NetBIOS name spoofing

[WINDOWS-SECURITY] Potential NetBIOS name spoofing

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-SECURITY] Potential NetBIOS name spoofing"; event_id: 8415; content: "NBNS spoofer was discovered"; nocase; parse_src_ip: 1; classtype: suspicious-traffic; reference: url,www.packtpub.com/mapt/book/networking_and_servers/9781785285561/5/ch05lvl1sec32/nbns-spoofing; sid:5003937; rev: 2;)

Field Validations

Loading…

Comments (0)

Loading comments...