ATT&CK T1569 - SMB Remote Service Execution Attempt
This rule detects attempts to execute remote services over SMB, specifically looking for traffic on port 445 containing both the SMB signature and the 'Service Control' string. This combination suggests an attempt to interact with or manipulate services on a remote system via SMB, which is a common technique used by attackers for lateral movement or privilege escalation.
Suricata
