?? 2941.txt
字號:
Rule:--Sid:2941--Summary:This event is generated when an attempt is made to bind to the Windowsregistry service via SMB. --Impact:Serious. Remote administration of the Windows reqistry may be possible.--Detailed Information:This event indicates that an attempt was made to bind to the Windowsregistry service via SMB across the network.It may be possible for an attacker to manipulate the Windows registryfrom a remote location. This could give the attacker administrativeprivileges on the target host as well as the opportunity to execute codeof their choosing.--Affected Systems: Microsoft Windows systems.--Attack Scenarios:If the Windows registry is accessible via SMB the attacker canmanipulate the operating system registry settings.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:None Known.--Corrective Action:Check the host for signs of system compromise.Turn off file and print sharing on the target host.Use a packet filtering firewall to disallow SMB access to the host fromsources external to the protected network.Disallow remote registry manipulation.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號