Feature #3297
closedmore verbose dcerpc logging
Description
Jason Taylor requested more verbose logging for dcerpc. He will provide examples with pcaps.
Files
Updated by Victor Julien about 5 years ago
- Related to Task #3288: Suricon 2019 brainstorm added
Updated by Victor Julien about 5 years ago
- Related to Optimization #2779: Convert DCE_RPC from C to Rust added
Updated by Victor Julien about 5 years ago
Currently only the DCERPC over SMB generates output as part of the SMB logging.
Updated by Jason Taylor about 5 years ago
looking at the pcaps I have there is a bit much to sanitize. I emailed the pcaps and logs to Victor. I will gather/organize some more pcap but wanted to get something over in the interim to give an idea of what we are looking for in a parser.
Updated by Joseph Feather almost 5 years ago
- File smb-on-windows-10.pcapng smb-on-windows-10.pcapng added
- File smb.json smb.json added
Suricata dcerpc output doesn't contain the opnum for the procedure call, in this example 15 (NetShareEnum). Full smb log is attached along with the pcap.
{
"timestamp": "2016-10-16T08:16:01.434363+0000",
"flow_id": 1881918157182233,
"pcap_cnt": 874,
"event_type": "smb",
"src_ip": "192.168.199.132",
"src_port": 49675,
"dest_ip": "192.168.199.133",
"dest_port": 445,
"proto": "TCP",
"smb": {
"id": 8,
"dialect": "3.11",
"command": "SMB2_COMMAND_WRITE",
"status": "STATUS_SUCCESS",
"status_code": "0x0",
"session_id": 127543348822037,
"tree_id": 1,
"dcerpc": {
"request": "BIND",
"response": "BINDACK",
"interfaces": [
{
"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
"version": "3.0",
"ack_result": 2,
"ack_reason": 0
},
{
"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
"version": "3.0",
"ack_result": 0,
"ack_reason": 0
},
{
"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
"version": "3.0",
"ack_result": 3,
"ack_reason": 0
}
],
"call_id": 2
}
},
"host": "roundrob2_eint"
}
Updated by Shivani Bhardwaj about 4 years ago
- Status changed from Feedback to Closed
- Assignee changed from Jason Taylor to Shivani Bhardwaj
- Target version changed from TBD to 6.0.0
Logging has been added to DCERPC now. It does log the opnum for requests now: https://github.com/OISF/suricata/pull/5190/commits/9f9670ebdc5ea15ccc35274dd48ca00165dcbe51
s-v test for the same: https://github.com/OISF/suricata-verify/tree/master/tests/dcerpc/dce-logging