Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 976 / 1026

sos5.1.0 high This protocol anomaly is an invalid calling name encoding
in the NETBIOS header that encapsulates an SMB. NETBIOS
names are 16 bytes and may encode to a maximum of 34
bytes. SMB:NETBIOS:INV-CDNAME-ENC
sos5.1.0 high This protocol anomaly is an invalid called name length in
the NETBIOS header that encapsulates an SMB. NETBIOS
names are 16 bytes and may encode to a maximum of 34
bytes. SMB:NETBIOS:INV-CDNAME-LEN
sos5.1.0 high This protocol anomaly is an invalid calling name encoding
in the NETBIOS header that encapsulates an SMB. NETBIOS
names are 16 bytes and may encode to a maximum of 34
bytes. SMB:NETBIOS:INV-CGNAME-ENC
sos5.1.0 high This protocol anomaly is an invalid calling name length in
the NETBIOS header that encapsulates an SMB. NETBIOS
names are 16 bytes and may encode to a maximum of 34
bytes. SMB:NETBIOS:INV-CGNAME-LEN
sos5.1.0 high This protocol anomaly is an invalid session header length in
the NETBIOS header that encapsulates an SMB. The
minimum length of an SMB message is 33 bytes. SMB:NETBIOS:INV-SHDR-LEN
sos5.1.0 high This protocol anomaly is an invalid session name length in
the NETBIOS header that encapsulates an SMB. NETBIOS
names are 16 bytes and may encode to a maximum of 34
bytes. SMB:NETBIOS:INV-SNAME-LEN
sos5.1.0 medium This signature detects attempts to remotely access the
Windows registry. Attackers may use a malicious client to
view or modify the contents of the Windows registry. SMB:NETBIOS:RMT-REG-ACCESS
sos5.1.0 medium This protocol anomaly is an SMB session with share-level
security. A user may gain access to various resources on the
server without username or password authentication. SMB:NETBIOS:SHARE-LVL-SEC
sos5.1.0 high This signature detects attempts to upload psexec.exe, an
SMB tool for uploading and executing programs interactively.
This signature also indicates that the psexec.exe has already
logged into the system; Psexec.exe can upload itself to the
host only after successful login. Worms often use psexec.exe
to propagate. SMB:TOOLS:PSEXEC
sos5.1.0 info This protocol anomaly is an invalid sequence of SMTP
commands, which would normally not be issued by an SMTP
client or server. This may indicate an attacker manually trying
to exploit an SMTP server SMTP:AUDIT:REQ-INVALID-CMD-SEQ
sos5.1.0 info This protocol anomaly is a text line (in the data section) in
an SMTP connection that is too long. This may indicate a
buffer overflow attempt. SMTP:AUDIT:TEXT-LINE
Copyright © 2010, Juniper Networks, Inc. 926
Network and Security Manager Administration Guide