Project

General

Profile

Actions
Copy link

Task #8692

open
SD SB

tracking: detect: DCERPC keywords coverage

Task #8692: tracking: detect: DCERPC keywords coverage

Added by Stuart DC 23 days ago. Updated 12 days ago.

Status:
Assigned
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Adding a few new keywords to simplify the rule detection logic. This should apply to both raw dcerpc (tcp/udp) and smb wrapped dcerpc.

dcerpc.ptype (packet type) - request (0x00), response (0x02), bind (0x0B), and fault (0x03)

Create sticky buffers for flags and header.
dcerpc.flags (stick buffer)
  • dcerpc.is_fragmented (bool) - standalone keyword indicating fragmentation.

dcerpc.header (stick buffer)

Subtasks 4 (4 open — 0 closed)

Feature #8733: detect: rule keyword for dcerpc.ptypeAssignedShivani BhardwajActions
Feature #8734: detect: rule keyword for dcerpc.flagsAssignedShivani BhardwajActions
Feature #8735: detect: rule keyword for dcerpc.headerAssignedShivani BhardwajActions
Feature #8736: detect: rule keyword for dcerpc.is_fragmentedAssignedShivani BhardwajActions

LS Updated by Lukas Sismis 20 days ago Actions
Copy link
 #1

  • Tracker changed from Feature to Task
  • Subject changed from New DCERPC Keywords to tracking: DCERPC keywords coverage
  • Status changed from New to Triaged
  • Assignee set to OISF Dev

I treat this original ticket as an idea aggregator.
When one starts creating the keywords, please create a ticket per keyword.

LS Updated by Lukas Sismis 20 days ago Actions
Copy link
 #2

  • Subject changed from tracking: DCERPC keywords coverage to tracking: detect: DCERPC keywords coverage

VJ Updated by Victor Julien 14 days ago Actions
Copy link
 #3

  • Status changed from Triaged to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 9.0.0-beta1

SB Updated by Shivani Bhardwaj 12 days ago Actions
Copy link
 #4

  • Subtask #8733 added

SB Updated by Shivani Bhardwaj 12 days ago Actions
Copy link
 #5

  • Subtask #8734 added

SB Updated by Shivani Bhardwaj 12 days ago Actions
Copy link
 #6

  • Subtask #8735 added

SB Updated by Shivani Bhardwaj 12 days ago Actions
Copy link
 #7

JFYI, DCERPC header is already available through the frame support using the syntax: frame:dcerpc.hdr. I'll also add a regular sticky buffer though. Added a ticket for that. :)

SB Updated by Shivani Bhardwaj 12 days ago Actions
Copy link
 #8

  • Subtask #8736 added
Actions
Copy link

Also available in: PDF Atom