Project

General

Profile

Actions

Bug #4925

closed

Bug #4767: Rule error in SMB dce_iface and dce_opnum keywords

Rule error in SMB dce_iface and dce_opnum keywords (6.0.x backport)

Added by Shivani Bhardwaj over 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The SMB dce_iface and dce_opnum keywords don't match.

Following rule and the associated pcap can be used to test this behavior:

alert smb any any -> any any (\
      msg: "SMB-DCE EnumPrinterDrivers";\
      dce_iface: 12345678-1234-abcd-ef00-0123456789ab;\
      dce_opnum: 10;\
      sid: 1;\
      )


Files

test-smb-dcerpc.pcapng (13.4 KB) test-smb-dcerpc.pcapng Pcap with SMB DCERPC traffic to test Eloy Pérez, 10/20/2021 09:56 AM
Actions

Also available in: Atom PDF