any pcap available for test https://github.com/fox-it/bro-scripts/blob/master/smb-ransomware/smb-ransomware.bro script -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20170503/fca86a53/attachment.html