Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity455Affected:No specific targets.False Positives: None known.ReferencesSMB InformationSMB Auth FailureBase Event:Details:Response:Affected:SMB_SESSION_BAD_PASSWORDUser gave an incorrect password during SMB logon.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesSMB InformationSMB Auth FailureBase Event:Details:Response:Affected:SMB_TREE_ACCESS_DENIEDGeneral SMB access denied condition.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesSMB InformationSMB Auth FailureBase Event:Details:Response:Affected:SMB_TREE_BAD_PASSWORDUser gave an incorrect password during SMB logon.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesSMB InformationSMB Guest ConnectionBase Event:Details:Response:NBT_SMB_GUEST_LOGINA NetBIOS guest logon attempt was detected.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.