#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DELETED NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; distance:110; within:5; content:"|F6387A76|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; classtype:attempted-admin; sid:2002188; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2018-09-13 19:37:50 UTC

Added 2018-09-13 17:52:44 UTC

#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DELETED NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; distance:110; within:5; content:"|F6387A76|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; classtype:attempted-admin; sid:2002188; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Added 2017-08-07 20:55:52 UTC

##alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DELETED NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; distance:110; within:5; content:"|F6387A76|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; classtype:attempted-admin; sid:2002188; rev:6;)

Added 2011-10-12 19:11:24 UTC

##alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DELETED NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; distance:110; within:5; content:"|F6387A76|"; classtype:attempted-admin; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; sid:2002188; rev:6;)

Added 2011-09-14 21:27:29 UTC

##alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DELETED NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; distance:110; within:5; content:"|F6387A76|"; classtype:attempted-admin; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_MS05-039; sid:2002188; rev:6;)

Added 2011-02-04 17:21:46 UTC

#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_MS05-039; sid:2002188; rev:5;)

Added 2009-02-07 22:00:25 UTC

#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; reference:url,doc.emergingthreats.net/bin/view/Main/2002188; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_MS05-039; sid:2002188; rev:5;)

Added 2009-02-07 22:00:25 UTC

#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; sid:2002188; rev:4;)

Added 2008-05-18 19:52:13 UTC

#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; sid:2002188; rev:4;)

Added 2008-05-18 19:52:13 UTC

#alert tcp any any -> any 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; sid:2002188; rev:3;)

Added 2008-01-25 10:56:38 UTC

#alert tcp any any -> any 445 (msg:"ET EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; sid:2002188; rev:3;)

Added 2008-01-25 10:56:38 UTC

#alert tcp any any -> any 445 (msg:"BLEEDING-EDGE EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; classtype:attempted-admin; sid:2002188; rev:2;)