Symantec™ Security Gateways Reference Guide - Sawmill

456 IDS eventsSuspicious activityAffected:No specific targets.False Positives: None known.ReferencesCAN-1999-0518SMB InformationSMB Guest ConnectionBase Event:Details:Response:Affected:SMB_GUEST_LOGON_ATTEMPTAn SMB logon with the username of “guest” was attempted. Attempts to use default or guestaccounts may indicate an information gathering or unauthorized access attempt.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesCAN-1999-0518SMB InformationSMB Malformed DataBase Event:Details:Response:Affected:SMB_INVALID_HEADERAn invalid SMB packet header was detected.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesCAN-1999-0518SMB InformationSMB Malformed DataBase Event:Details:Response:Affected:SMB_SHORT_BATCHED_PAYLOADThe batched payload on the SMB packet was shorter than expected.If seen in sufficient volume or variation, and other suspicious factors exist, audit of client andserver is recommended. Examination of the packet contents may provide some additionalinformation about the particular command.No specific targets.False Positives: None known.ReferencesCAN-1999-0518SMB Information