From c15a87bd7c6b66ee2f8cb81e1e5024023f2106bf Mon Sep 17 00:00:00 2001 From: sandeep <8293321+ehsandeep@users.noreply.github.com> Date: Tue, 29 Jun 2021 00:09:57 +0530 Subject: [PATCH] more changes --- network/{smb1-detection.yaml => smb-v1-detection.yaml} | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) rename network/{smb1-detection.yaml => smb-v1-detection.yaml} (77%) diff --git a/network/smb1-detection.yaml b/network/smb-v1-detection.yaml similarity index 77% rename from network/smb1-detection.yaml rename to network/smb-v1-detection.yaml index ca6890af6a..ef70dc9c0d 100644 --- a/network/smb1-detection.yaml +++ b/network/smb-v1-detection.yaml @@ -1,18 +1,21 @@ -id: SMB-V1 Detection +id: smb-v1-detection + info: name: SMB-V1 Detection author: pussycat0x severity: low - tags: network,windows,smb,version,service - description: SMB Version 1 Detection + tags: network,windows,smb,service reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/ + network: - inputs: - data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200 type: hex + host: - "{{Hostname}}" - "{{Hostname}}:445" + matchers: - type: word words: