SNORT Rule for netbios brute force break-in

["Robert Caplan" <rjc7001 () dbmi columbia edu>]

My network administrators are constantly flooded with requests to reset Windows accounts which have been locked out 
because of brute force/dictionary breakin accounts on the netbios port.  Intrudors are able to enumerate the usernames 
and by brute force attempt to gain access.  Does anyone know of a Snort rule which will detect this behavior?

Thanks,

Robert Caplan