NetBIOS Name Service Enumeration Sweep

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects a NetBIOS Name Service enumeration sweep. It triggers an alert when 15 or more UDP packets destined for port 137 (NetBIOS Name Service) on the home network are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker attempting to discover hosts and services on a network.