ATTACK AD [PTsecurity] IREMOTEWINSPOOL Bind

SID: 10006624Rev: 3Enabled18 views
Fileptopen-windows.rules
CreatedJune 24, 2025
UpdatedJune 24, 2025
Classificationattempted-admin
alert tcp-pkt any any -> any any (msg:"ATTACK AD [PTsecurity] IREMOTEWINSPOOL Bind"; flow:established, to_server; content:"|96 3F F0 76 FD CD FC 44 A2 2C 64 95 0A 00 12 09|"; flowbits:set, DCERPC.IREMOTEWINSPOOL.Bind; flowbits:noalert; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10006624; rev:3;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!