Today we have been getting numerous RPC WinNuke id=3345 version=S226 type=other created=20050318 alerts. The "attacker" has a private from a remote branch, going through LAN-LAN tunnel to the IPS to the active directory server, port 135. Is the attac...