Project

General

Profile

Actions
Copy link

Task #8692

open
SD SB

tracking: detect: DCERPC keywords coverage

Task #8692: tracking: detect: DCERPC keywords coverage

Added by Stuart DC 24 days ago. Updated about 12 hours ago.

Status:
Assigned
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Adding a few new keywords to simplify the rule detection logic. This should apply to both raw dcerpc (tcp/udp) and smb wrapped dcerpc.

dcerpc.ptype (packet type) - request (0x00), response (0x02), bind (0x0B), and fault (0x03)

Create sticky buffers for flags and header.
dcerpc.flags (stick buffer)
  • dcerpc.is_fragmented (bool) - standalone keyword indicating fragmentation.

dcerpc.header (stick buffer)

Subtasks 5 (5 open — 0 closed)

Feature #8733: detect: rule keyword for dcerpc.ptypeAssignedShivani BhardwajActions
Feature #8762: dcerpc: record unhandled PDU typesAssignedShivani BhardwajActions
Feature #8734: detect: rule keyword for dcerpc.flagsAssignedShivani BhardwajActions
Feature #8735: detect: rule keyword for dcerpc.headerAssignedShivani BhardwajActions
Feature #8736: detect: rule keyword for dcerpc.is_fragmentedAssignedShivani BhardwajActions

LS Updated by Lukas Sismis 21 days ago Actions
Copy link
 #1

  • Tracker changed from Feature to Task
  • Subject changed from New DCERPC Keywords to tracking: DCERPC keywords coverage
  • Status changed from New to Triaged
  • Assignee set to OISF Dev

I treat this original ticket as an idea aggregator.
When one starts creating the keywords, please create a ticket per keyword.

LS Updated by Lukas Sismis 21 days ago Actions
Copy link
 #2

  • Subject changed from tracking: DCERPC keywords coverage to tracking: detect: DCERPC keywords coverage

VJ Updated by Victor Julien 15 days ago Actions
Copy link
 #3

  • Status changed from Triaged to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 9.0.0-beta1

SB Updated by Shivani Bhardwaj 14 days ago Actions
Copy link
 #4

  • Subtask #8733 added

SB Updated by Shivani Bhardwaj 14 days ago Actions
Copy link
 #5

  • Subtask #8734 added

SB Updated by Shivani Bhardwaj 14 days ago Actions
Copy link
 #6

  • Subtask #8735 added

SB Updated by Shivani Bhardwaj 14 days ago Actions
Copy link
 #7

JFYI, DCERPC header is already available through the frame support using the syntax: frame:dcerpc.hdr. I'll also add a regular sticky buffer though. Added a ticket for that. :)

SB Updated by Shivani Bhardwaj 14 days ago Actions
Copy link
 #8

  • Subtask #8736 added

SB Updated by Shivani Bhardwaj about 19 hours ago ยท Edited Actions
Copy link
 #9

Hi @stu4rt ! Could you please tell your expectations regarding "dcerpc.flags" being a sticky keyword? I was going to implement it as an integer like "tcp.flags" but checked this description before to get an idea of what's needed. Stringified names for flags can also be made available.

SD Updated by Stuart DC about 12 hours ago Actions
Copy link
 #10

Shivani Bhardwaj wrote in #note-9:

Hi @stu4rt ! Could you please tell your expectations regarding "dcerpc.flags" being a sticky keyword? I was going to implement it as an integer like "tcp.flags" but checked this description before to get an idea of what's needed. Stringified names for flags can also be made available.

@Shivani Bhardwaj If dcerpc.flags is implemented similarly as tcp.flags, i think that would be great. it doesn't need to be a sticky buffer for my needs.

Actions
Copy link

Also available in: PDF Atom