GPL NETBIOS SMB ISystemActivator little endian bind attempt

alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (
    msg:"GPL NETBIOS SMB ISystemActivator little endian bind attempt";
    flow:established,to_server;
    content:"|00|"; depth:1;
    content:"|FF|SMB%"; within:5; distance:3;
    byte_test:1,!&,128,6,relative;
    content:"&|00|"; within:2; distance:56;
    content:"|5C|PIPE|5C 00|"; distance:4; nocase;
    byte_jump:2,-17,relative,from_beginning,little;
    isdataat:4,relative;
    content:"|05|";
    byte_test:1,&,16,3,relative;
    content:"|0B|"; within:1; distance:1;
    content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29;
    flowbits:set,dce.isystemactivator.bind;
    flowbits:noalert;
    classtype:protocol-command-decode;
    sid:2103394; rev:4;
    metadata:created_at 2010_09_23, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)