""GPL NETBIOS SMB repeated logon failure""
SID: 2102923
Revision: 4
Class Type: unsuccessful-user
Metadata: created_at 2010_09_23, updated_at 2012_09_14
Reference:
Protocol: tcp
Source Network: $HOME_NET
Source Port: 139
Destination Network: $EXTERNAL_NET
Destination Port: any
Flow: from_server,established
Contents:
-
Value: "|FF|SMB" Depth: 4 Offset: 4
-
Value: "s"
-
Value: "m|00 00 C0|"
Within: 4
PCRE:
Special Options: