Project

General

Profile

Actions

Bug #5160

open

smb: Misguiding keyword smb.named_pipe

Added by Eloy PĂ©rez 7 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

The "smb.named_pipe" this keyword is used to match shares in the tree_connect request that contains named pipes (such as the IPC$).

I think here we are not using the proper terminology because IPC$ is not a named pipe, IPC$ is a pipe share, the share used to access named_pipes. The named pipes themselves are those "special files" under IPC$ used to connect with an specific service in the target machine, like "samr", "lsarpc", etc.

Therefore I think the name of the keyword is misguiding and something like "smb.pipe_share" would be more accurate.

No data to display

Actions

Also available in: Atom PDF