🐾 - 🔔 SAMR - Suspicious Map Request 🪟 to an IP Address - Possible Impacket addcomputer script targeting Active Directory 🥷 - S0357 - T1136.002
Sourcepawpatrules
FilePAW-PATRULES_LATERAL_MOVEMENT.rules
CreatedDecember 29, 2023
UpdatedJanuary 3, 2024
Classificationattempted-recon
alert tcp-pkt any any -> $HOME_NET 135 (msg:"🐾 - 🔔 SAMR - Suspicious Map Request 🪟 to an IP Address - Possible Impacket addcomputer script targeting Active Directory 🥷 - S0357 - T1136.002"; flow:to_server, stateless ; content:"|05 00 00|"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; content:"|78 57 34 12 34 12 cd ab ef 00 01 23 45 67 89 ac|"; fast_pattern; content:"|01 00 11 0d 00|"; pcre:"/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/" ; reference:url,https://attack.mitre.org/software/S0357/ ; reference:url,https://attack.mitre.org/techniques/T1136/002/ ; reference:url,https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/084da2e7-0ba0-44fc-8f17-e8a200c69eb5 ; reference:url,https://0xffsec.com/handbook/services/msrpc/ ; reference:url,https://www.secureauth.com/labs/open-source-tools/impacket/ ; reference:url,https://github.com/fortra/impacket/blob/master/examples/addcomputer.py ; metadata:created_at 2023_12_29, updated_at 2024_01_03; sid:3301105; rev:4; classtype:attempted-recon;)
References
Metadata
created at2023_12_29
updated at2024_01_03
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!