ET EXPLOIT Possible GoldenPac Priv Esc in-use

Query · suricata

flow:established,to_server;
content:"|a0 07 03 05 00 50 80 00 00|";
content:"|a8 05 30 03 02 01 17|"; endswith;
threshold:type limit, track by_src, seconds 60, count 1;
Raw source ET EXPLOIT Possible GoldenPac Priv Esc in-use · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp any any -> $HOME_NET 88 (
    msg:"ET EXPLOIT Possible GoldenPac Priv Esc in-use";
    flow:established,to_server;
    content:"|a0 07 03 05 00 50 80 00 00|";
    content:"|a8 05 30 03 02 01 17|"; endswith;
    threshold:type limit, track by_src, seconds 60, count 1;
    reference:url,code.google.com/p/impacket/source/browse/trunk/examples/goldenPac.py;
    reference:cve,CVE-2014-6324;
    classtype:attempted-admin;
    sid:2019922; rev:4;
    metadata:created_at 2014_12_12, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2022_03_24, reviewed_at 2024_03_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.