ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound
Sourceet/open
Fileemerging-attack_response.rules
CreatedJanuary 5, 2015
UpdatedJuly 26, 2019
Classificationsuccessful-admin
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE SysInternals sc.exe Output Outbound"; flow:established; content:"SERVICE_NAME|3a|"; content:"TYPE"; distance:0; content:"SERVICE_EXIT_CODE"; distance:0; classtype:successful-admin; sid:2020088; rev:1; metadata:created_at 2015_01_05, signature_severity Minor, updated_at 2019_07_26;)
Metadata
created at2015_01_05
signature severityMinor
updated at2019_07_26
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!