Permission Group Membership Enumerated Remotely
This rule detects attempts to enumerate permission group memberships remotely over the Server Message Block (SMB) protocol, specifically targeting port 445. The detection is based on the presence of the case-insensitive string "NetGroupEnum" within the TCP payload, indicating a network scan or reconnaissance activity aimed at discovering group information.
Suricata
