Suricata Output

Help
1

s
s542×579 135 KB

Hello, I’m new using Suricata.

I got a Suricat output by a wireshark packet sniffing, but I don’t understand what it means:

ET POLICY SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement
GPL MISC UPnP service discover attempt

Could you recommend me, please, some guide to learn about it.

Thanks for your help.

2

This is a Emerging Threats Signature that gives you the hint for potential Lateral Movement, but this can also be a false positive. You would have to look deeper into the traffic pattern if other signatures have hit for same/related flows.