""ET SCAN DCERPC rpcmgmt ifids Unauthenticated BIND""
SID: 2009832
Revision: 6
Class Type: attempted-recon
Metadata: created_at 2010_07_30, updated_at 2010_10_26
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: [135,139,445,1024:2048]
Flow: established,to_server
Contents:
-
Value: "|05|"
-
Value: "|80 bd a8 af 8a 7d c9 11 be f4 08 00 2b 10 29 89|"
Within:
PCRE:
Special Options: