""ET EXPLOIT NTDump Session Established Reg-Entry port 445""

SID: 2001543

Revision: 8

Class Type: misc-activity

Metadata: created_at 2010_07_30, updated_at 2010_11_04

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: 445

Flow: to_server,established

Contents:

• Value: "|53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4e 00 74 00 44 00 75 00 6d 00 70 00|"

Within:

PCRE:

Special Options:

source