Intrusion Prevention

SMB.DCERPC.Share.Enumeration

Description

This indicates that a DCERPC NetrShareEnum request was detected. This request is suspicious when it is sent from external network.
NetrShareEnum is one of the srvsvc interface operations used to manage the lanmanserver service.

Affected Products

Any unprotected Windows version is vulnerable.

Impact

Information disclosure: may be used to conduct further attacks.

Recommended Actions

Block TCP ports 139 and 445 at the perimeter firewall.