Project

General

Profile

Actions
Copy link

Bug #4767

closed
EP EP

Rule error in SMB dce_iface and dce_opnum keywords

Bug #4767: Rule error in SMB dce_iface and dce_opnum keywords

Added by Eloy Pérez about 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Eloy Pérez
Target version:
7.0.0-beta1
Affected Versions:
6.0.1
Effort:
Difficulty:
Label:

Description

The SMB dce_iface and dce_opnum keywords don't match.

Following rule and the associated pcap can be used to test this behavior:

alert smb any any -> any any (\
      msg: "SMB-DCE EnumPrinterDrivers";\
      dce_iface: 12345678-1234-abcd-ef00-0123456789ab;\
      dce_opnum: 10;\
      sid: 1;\
      )

Files

test-smb-dcerpc.pcapng (13.4 KB) test-smb-dcerpc.pcapng Pcap with SMB DCERPC traffic to test Eloy Pérez, 10/20/2021 09:56 AM

Subtasks 2 (0 open — 2 closed)

Bug #4925: Rule error in SMB dce_iface and dce_opnum keywords (6.0.x backport)ClosedEloy PérezActions
Bug #4926: Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport)ClosedVictor JulienActions

Related issues 2 (0 open — 2 closed)

Related to Suricata - Bug #4769: dcerpc dce_iface just match a packetClosedEloy PérezActions
Related to Suricata - Bug #3109: dcerpc engine not generating alertsClosedShivani BhardwajActions

VJ Updated by Victor Julien about 5 years ago Actions
Copy link
 #1

  • Related to Bug #4769: dcerpc dce_iface just match a packet added

VJ Updated by Victor Julien about 5 years ago Actions
Copy link
 #2

  • Related to Bug #3109: dcerpc engine not generating alerts added

SB Updated by Shivani Bhardwaj almost 5 years ago Actions
Copy link
 #3

  • Status changed from New to Assigned
  • Target version set to 7.0.0-beta1
  • Label Needs backport to 5.0, Needs backport to 6.0 added

SB Updated by Shivani Bhardwaj almost 5 years ago Actions
Copy link
 #4

  • Copied to Bug #4925: Rule error in SMB dce_iface and dce_opnum keywords (6.0.x backport) added

SB Updated by Shivani Bhardwaj almost 5 years ago Actions
Copy link
 #5

  • Copied to Bug #4926: Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport) added

SB Updated by Shivani Bhardwaj almost 5 years ago Actions
Copy link
 #6

  • Status changed from Assigned to Closed

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #7

  • Label deleted (Needs backport to 5.0, Needs backport to 6.0)
Actions
Copy link

Also available in: PDF Atom