Hi,
You could use the next signature:
SMB_Executable_Access
-----Original Message-----
From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net]On
Behalf Of keshav anand
Sent: Tuesday, January 25, 2005 5:57 AM
To: issforum@iss.net
Subject: [ISSForum] signature to enable for tracking denied
file/driveaccess ?
Dear Members,
I need to know which signature i need to enable if i
need to track the users accessing file shares and
getting denied access .
I would be interested in getting the source ip ,dst
ip,src port,dst port,file name,drive (C,D or E etc for
windows or relevant drive names for other os),username
and password the user used for accessing the shared
file/folder and got denied.
I tried with smb_empty_password , but this doesnot
provide info on the file names , drive
letters,username etc
Any insight on this would be highly appreciated.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
