crowdsec/config/patterns/smb
Thibault bui Koechlin 2016167654 initial import
2020-05-15 11:39:16 +02:00

1 line
No EOL
173 B
Text

SMB_AUTH_FAIL Auth:%{GREEDYDATA} user \[%{DATA:smb_domain}\]\\\[%{DATA:user}\]%{GREEDYDATA} status \[NT_STATUS_NO_SUCH_USER\]%{GREEDYDATA} remote host \[ipv4:%{IP:ip_source}