Szczególy klastra: SMB / NTLMSSP negotiation (445/TCP)

Nazwa: SMB / NTLMSSP negotiation (445/TCP)
Data: 2010-04-24 12:30:31
Poziom klasyfikacji: Normal
Rdzeń: SMB / NTLMSSP negotiation (445/TCP)
Porty: 445/TCP
Unikalnych źródeł: 243
Rozmiar sygnatury: 239
Sygnatura klastra:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB / NTLMSSP negotiation (445/TCP)"; flow:to_ser\
ver,established; content:"|d7|m|0c ff 00 00 00 df ff 02 00 01 00 00 00 00 00 af 00 00 00 00 00|\\|d0\
00 80 d2 00 a1 81 ac|0|81 a9 a2 81 a6 04 81 a3|NTLMSSP|00 03 00 00 00 18 00 18 00|@|00 00 00 18 00 \
18 00|X|00 00 00 12 00 12 00|p|00 00 00 00 00 00 00 82 00 00 00| |00| |00 82 00 00 00 00 00 00 00 a2\
00 00 00 01 02 08 00 ed b7|9|88|w|d7 16 be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|B|ae b7 \
1f bb|m|c1 84 99 01|k|08 b1|x|ba|eC|0a d3 9a e2|I|86|)W|00|O|00|R|00|K|00|G|00|R|00|O|00|U|00|P|00|l\
|00|Q|00|P|00|x|00|f|00|2|00|I|00|S|00|Q|00|g|00|E|00|V|00|1|00|b|00|G|00|K|00 00|Windows 2000 2195|\
00|Windows 2000 5.0|00|";)