System Service Enumeration via Remote SMB
This rule detects attempts to enumerate system services on a remote host via the Server Message Block (SMB) protocol. Specifically, it looks for network traffic on TCP port 445 (SMB) containing the strings "svcctl" and "EnumServicesStatus" (case-insensitive), which are indicative of a remote service control request to list services.
Suricata
