Actions
Feature #8403
opensmb: add samr_UserInfo details to EVE logs
Effort:
Difficulty:
Label:
Description
samr_UserInfo such as Account Name and Full Name is available in the SMB payload, and we can potentially
detect credential theft with them, but they're not exposed as JSON fields in our logs.
These are good candidates to be logged.
I've added a pcap to #5685 that has these fields as example on packet 339.
Updated by Victor Julien about 11 hours ago
- Related to Task #5685: tracking: active directory protocols support added
Actions