[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] signature to enable for tracking denied file/driveaccess ?



Hi,

You could use the next signature:

SMB_Executable_Access


-----Original Message-----
From: issforum-bounces@xxxxxxx [mailto:issforum-bounces@xxxxxxx]On
Behalf Of keshav anand
Sent: Tuesday, January 25, 2005 5:57 AM
To: issforum@xxxxxxx
Subject: [ISSForum] signature to enable for tracking denied
file/driveaccess ?


Dear Members,

I need to know which signature i need to enable if i
need to track the users accessing file shares and
getting denied access .

I would be interested in getting the source ip ,dst
ip,src port,dst port,file name,drive (C,D or E etc for
windows or relevant drive names for other os),username
and password the user used for accessing the shared
file/folder and got denied.

I tried with smb_empty_password , but this doesnot
provide info on the file names , drive
letters,username etc

Any insight on this would be highly appreciated.


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.