Sagan medium stable other
[WINDOWS-SECURITY] Potential NetBIOS name spoofing
[WINDOWS-SECURITY] Potential NetBIOS name spoofing
Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-SECURITY] Potential NetBIOS name spoofing"; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 8415; content: "NBNS spoofer was discovered"; nocase; parse_src_ip: 1; classtype: suspicious-traffic; reference: url,www.packtpub.com/mapt/book/networking_and_servers/9781785285561/5/ch05lvl1sec32/nbns-spoofing; sid:5009755; metadata: created_on 2022_11_22, old_sid 5003937; rev: 2;) Field Validations
Loading…
Comments (0)
Loading comments...