Remote System Shutdown Initiated via SMB
This rule detects attempts to initiate a remote system shutdown via the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic directed to port 445 (SMB) on the home network. This activity is often associated with malicious behavior, such as ransomware or destructive attacks, aiming to disrupt systems.
Suricata
