Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
MS-RPC:SAMR-ACCESS-DENIED |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
MS-RPC |
Keywords |
SAMR Access Denied |
Release Date |
2004/09/30 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
MS-RPC: SAMR Access Denied
This signature detects failed attempts to connect to the Security Account Manager Remote (SAMR) service on Microsoft Windows. Attackers can be probing your server for vulnerabilities, as a successful login to this service provides important information such as administrator account details, default domain names, open users, and active groups. However, because system administrators also use the SAMR service legitimately, this signature can also detect non-malicious activity.
Extended Description
None
References