Rule:--Sid:2482--Summary:This event is generated when an attempt is made to shutdown a service via SMB. --Impact:Serious.--Detailed Information:This event indicates that an attempt was made to shutdown a service on a system using SMB across the network.--Affected Systems:Microsoft Windows systems.--Attack Scenarios:An attacker may try to deny services to other users.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:None Known.--Corrective Action:Check the host for signs of system compromise.Turn off file and print sharing on the target host.Use a packet filtering firewall to disallow SMB access to the host from sources external to the protected network.--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--