alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:cve,2003-0533; classtype:misc-activity; sid:2000033; rev:9;)

Added 2011-10-12 19:09:28 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:cve,2003-0533; sid:2000033; rev:9;)

Added 2011-09-15 14:46:01 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:cve,2003-0533; sid:2000033; rev:9;)

Added 2011-09-14 20:32:57 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP; reference:cve,2003-0533; sid:2000033; rev:9;)

Added 2011-02-04 17:21:11 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP; reference:cve,2003-0533; sid:2000033; rev:9;)

Added 2010-01-29 11:39:58 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP; reference:cve,2003-0533; sid:2000033; rev:9;)

Added 2010-01-29 11:39:58 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP; sid: 2000033; rev:8;)

Added 2009-02-07 22:00:25 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP; sid: 2000033; rev:8;)

Added 2009-02-07 22:00:25 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; sid: 2000033; rev:7;)

Added 2008-05-18 19:52:13 UTC

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; sid: 2000033; rev:7;)

Added 2008-05-18 19:52:13 UTC

alert tcp any any -> any 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; sid: 2000033; rev:6;)

Added 2008-01-25 10:56:37 UTC

alert tcp any any -> any 445 (msg:"ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; sid: 2000033; rev:6;)

Added 2008-01-25 10:56:37 UTC

alert tcp any any -> any 445 (msg: "BLEEDING-EDGE EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP?)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B? A6 E9 31 31|"; classtype: misc-activity; sid: 2000033; rev:5; )