Project

General

Profile

Actions
Copy link

Feature #8691

open
SD OD

detect: SNMP Varbind Keywords

Feature #8691: detect: SNMP Varbind Keywords

Added by Stuart DC 25 days ago. Updated 11 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

In recent exploitation of CVE-2025-20352, it would have been ideal to alert on shell metachars in a reconstructed SNMP value across a session, but since the commands were split across multiple SNMP packets, each carrying small payloads this made the attempt to detection near impossible without major performance implications.

SNMP can carry multiple varbinds in a single request. Each varbind appears as a triplet:
  • snmp.oid - (sticky buffer) keyword to match exactly or a prefix (subtree) OID
  • snmp.data_type - (e.g int32 - "2", octet string - "Cisco IOS Software, Catalyst 4500", counter32/64 - "41239842", time ticks - "1452300", ip address - "192.168.1.50", null - "0x0500")
  • snmp.value - (sticky buffer) decoded [full] value across a session

Files

SNMPv2c_get_requests.pcap (894 Bytes) SNMPv2c_get_requests.pcap Stuart DC, 07/14/2026 02:34 PM

LS Updated by Lukas Sismis 23 days ago Actions
Copy link
 #1

  • Subject changed from SNMP Varbind Keywords to detect: SNMP Varbind Keywords
  • Status changed from New to Triaged
  • Assignee set to OISF Dev

Could you supply a PCAP for this by any chance?

SD Updated by Stuart DC 11 days ago Actions
Copy link
 #3

Lukas Sismis wrote in #note-1:

Could you supply a PCAP for this by any chance?

Added a pcap to the ticket.

Actions
Copy link

Also available in: PDF Atom