Project

General

Profile

Actions
Copy link

Feature #8403

open
JF CT

smb: add samr_UserInfo details to EVE logs

Feature #8403: smb: add samr_UserInfo details to EVE logs

Added by Juliana Fajardini Reichow 5 months ago. Updated 16 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
Community Ticket
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

samr_UserInfo such as Account Name and Full Name is available in the SMB payload, and we can potentially
detect credential theft with them, but they're not exposed as JSON fields in our logs.

These are good candidates to be logged.

I've added a pcap to #5685 that has these fields as example on packet 339.

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #5685: tracking: active directory protocols supportAssignedVictor JulienActions

VJ Updated by Victor Julien 5 months ago Actions
Copy link
 #1

  • Description updated (diff)

VJ Updated by Victor Julien 5 months ago Actions
Copy link
 #2

  • Related to Task #5685: tracking: active directory protocols support added

PA Updated by Philippe Antoine 16 days ago Actions
Copy link
 #3

  • Status changed from New to Triaged
  • Assignee set to Community Ticket
Actions
Copy link

Also available in: PDF Atom