Project

General

Profile

Actions
Copy link

Bug #4769

closed
EP EP

dcerpc dce_iface just match a packet

Bug #4769: dcerpc dce_iface just match a packet

Added by Eloy Pérez over 4 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
High
Assignee:
Eloy Pérez
Target version:
7.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

The dce_iface dcerpc keyword just match the packet following the bind.

alert dcerpc any any -> any any (\
      msg: "DCE Netlogon";\
      flow: to_server;\
      dce_iface: 12345678-1234-abcd-ef00-01234567cffb;\
      sid: 1;\
      )

Files

test-dce-iface.pcapng (3.34 KB) test-dce-iface.pcapng Pcap with many dcerpc requests Eloy Pérez, 10/20/2021 11:12 AM

Related issues 4 (0 open — 4 closed)

Related to Suricata - Bug #3109: dcerpc engine not generating alertsClosedShivani BhardwajActions
Related to Suricata - Bug #4767: Rule error in SMB dce_iface and dce_opnum keywordsClosedEloy PérezActions
Copied to Suricata - Bug #4927: dcerpc dce_iface just match a packetClosedEloy PérezActions
Copied to Suricata - Bug #4928: dcerpc dce_iface just match a packet (5.0.x backport)RejectedActions

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #1

  • Related to Bug #3109: dcerpc engine not generating alerts added

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #2

  • Related to Bug #4767: Rule error in SMB dce_iface and dce_opnum keywords added

SB Updated by Shivani Bhardwaj over 4 years ago Actions
Copy link
 #3

  • Status changed from New to Assigned
  • Target version set to 7.0.0-beta1
  • Label Needs backport to 5.0, Needs backport to 6.0 added

SB Updated by Shivani Bhardwaj over 4 years ago Actions
Copy link
 #4

  • Copied to Bug #4927: dcerpc dce_iface just match a packet added

SB Updated by Shivani Bhardwaj over 4 years ago Actions
Copy link
 #5

  • Copied to Bug #4928: dcerpc dce_iface just match a packet (5.0.x backport) added

SB Updated by Shivani Bhardwaj about 4 years ago Actions
Copy link
 #6

  • Status changed from Assigned to Closed
Actions
Copy link

Also available in: PDF Atom