Project

General

Profile

Actions

Bug #5161

open

Suricata fails to see SMB file

Added by Angelo Mirabella 7 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Suricata fails to alert on a smb signature related to a file extraction.

Investigating a bit the issue the "file_data" keyword does not match (PrefilterTxFiledata) because a file is never seen by Suricata.

Attaching pcap and signature.


Files

test.pcap (3.27 MB) test.pcap Angelo Mirabella, 02/24/2022 02:44 PM
test.rule (139 Bytes) test.rule Angelo Mirabella, 02/24/2022 02:44 PM

No data to display

Actions

Also available in: Atom PDF