SMB login failed
advICE :Intrusions : 2001606

Summary

Multiple SMB logon failures using bad user names and/or passwords.

Details

An intruder may be attempting to login repeatedly using different user names and passwords. You should ensure you have good passwords on all your remotely accessible services.

parametric information victim The IP address of the system on which the login attempt occurred. login The login name attempted.

configuration for this item login.smb.count 4 The number of failed logins to trigger this intrusion detection. login.smb.interval 3600 The time interval (in seconds) over which the login failures are measured.

 
Version appeared: