alert syslog $EXTERNAL_NET any -> $HOME_NET any (msg:"[SAMBA] Connection denied"; pcre: "/denied connection from|connection denied from/i"; nocase; classtype: unsuccessful-user; program: smbd; reference: url,wiki.quadrantsec.com/bin/view/Main/5000146; sid: 5000146; rev:1;)
-- Main.Sagan-Wiki-Add - 2015-10-21
New revisions of 5000146 will be below...