alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"ET NETBIOS SMB DCERPC PnP bind attempt"; flow:established,to_server; flowbits:set,netbios.pnp.bind.attempt; flowbits:noalert; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"|40 4E 9F 8D 3D A0 CE 11 8F 69 08 00 3E 30 05 1B|"; classtype:protocol-command-decode; sid:2002202; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Unknown, updated_at 2024_03_14;)