Symantec™ Security Gateways Reference Guide - Sawmill

454 IDS eventsSuspicious activityResponse:Affected:If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.RSH Malformed DataBase Event:Details:Response:Affected:RSH_INVALID_LOC_LOGIN_FIELDAn invalid username was specified as the local user in an rsh session.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.RSH Malformed DataBase Event:Details:Response:Affected:RSH_INVALID_SERVER_INITThe server sent a response that didn’t appear to be a normal rsh response.If seen in sufficient volume or variation, location and audit of client and server is recommended.Examination of the packet contents may provide some additional information about the particularcommand.No specific targets.False Positives: None known.SMB Auth FailureBase Event:Details:Response:Affected:SMB_DEL_ACCESS_DENIEDAn SMB delete (file or remove directory) command was issued, but the request resulted in an accessdenied error message.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesSMB InformationSMB Auth FailureBase Event:Details:Response:SMB_SESSION_ACCESS_DENIEDGeneral SMB access denied condition. For example, if a request to a resource such as disk or printershare is made, but the user ID with which the command is issued is not in the ACL list of theresource, the server will return an error that would trigger this event.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.