SMB Notes for Triage

##Checklist

• Identify SMB dialects in pcaps
• Watch for suspicious Trans2 / NT Trans patterns

##Minimal snippet

tcp.port == 445
smb2 && smb2.cmd == 1