Project

General

Profile

Actions
Copy link

Bug #4926

closed
SB VJ

Bug #4767: Rule error in SMB dce_iface and dce_opnum keywords

Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport)

Bug #4926: Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport)

Added by Shivani Bhardwaj over 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
5.0.10
Affected Versions:
5.0.8
Effort:
Difficulty:
Label:

Description

The SMB dce_iface and dce_opnum keywords don't match.

Following rule and the associated pcap can be used to test this behavior:

alert smb any any -> any any (\
      msg: "SMB-DCE EnumPrinterDrivers";\
      dce_iface: 12345678-1234-abcd-ef00-0123456789ab;\
      dce_opnum: 10;\
      sid: 1;\
      )

Files

test-smb-dcerpc.pcapng (13.4 KB) test-smb-dcerpc.pcapng Pcap with SMB DCERPC traffic to test Eloy Pérez, 10/20/2021 09:56 AM

SB Updated by Shivani Bhardwaj over 4 years ago Actions
Copy link
 #1

  • Copied from Bug #4767: Rule error in SMB dce_iface and dce_opnum keywords added

EP Updated by Eloy Pérez about 4 years ago Actions
Copy link
 #2

  • Assignee changed from Shivani Bhardwaj to Eloy Pérez

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #3

  • Target version changed from 5.0.9 to 5.0.10

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #4

  • Status changed from Assigned to Closed
  • Assignee changed from Eloy Pérez to Victor Julien
  • Priority changed from High to Normal

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #5

  • Subject changed from Rule error in SMB dce_iface and dce_opnum keywords to Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport)
  • Parent task set to #4767
Actions
Copy link

Also available in: PDF Atom