Task #8692: tracking: detect: DCERPC keywords coverage - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community
Open Doc tasks

Actions

Copy link

Task #8692

open

SD SB

tracking: detect: DCERPC keywords coverage

Task #8692: tracking: detect: DCERPC keywords coverage

Added by Stuart DC 2 months ago. Updated 11 days ago.

Status:

Assigned

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

9.0.0-beta1

Effort:

Difficulty:

Label:

Description

Adding a few new keywords to simplify the rule detection logic. This should apply to both raw dcerpc (tcp/udp) and smb wrapped dcerpc.

dcerpc.ptype (packet type) - request (0x00), response (0x02), bind (0x0B), and fault (0x03)

Create sticky buffers for flags and header.
dcerpc.flags (stick buffer)

dcerpc.is_fragmented (bool) - standalone keyword indicating fragmentation.

dcerpc.header (stick buffer)

Subtasks 5 (5 open — 0 closed)

Feature #8733: detect: rule keyword for dcerpc.ptype	In Review	Shivani Bhardwaj	Actions
Feature #8762: dcerpc: record unhandled PDU types	In Review	Shivani Bhardwaj	Actions
Feature #8734: detect: rule keyword for dcerpc.flags	In Review	Shivani Bhardwaj	Actions
Feature #8735: detect: rule keyword for dcerpc.header	In Review	Shivani Bhardwaj	Actions
Feature #8736: detect: rule keyword for dcerpc.is_fragmented	In Review	Shivani Bhardwaj	Actions

History
Notes
Property changes

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#1

Tracker changed from Feature to Task
Subject changed from New DCERPC Keywords to tracking: DCERPC keywords coverage
Status changed from New to Triaged
Assignee set to OISF Dev

I treat this original ticket as an idea aggregator.
When one starts creating the keywords, please create a ticket per keyword.

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#2

Subject changed from tracking: DCERPC keywords coverage to tracking: detect: DCERPC keywords coverage

VJ Updated by Victor Julien about 2 months ago Actions
Copy link
#3

Status changed from Triaged to Assigned
Assignee changed from OISF Dev to Shivani Bhardwaj
Target version changed from TBD to 9.0.0-beta1

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#4

Subtask #8733 added

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#5

Subtask #8734 added

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#6

Subtask #8735 added

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#7

JFYI, DCERPC header is already available through the frame support using the syntax: frame:dcerpc.hdr. I'll also add a regular sticky buffer though. Added a ticket for that. :)

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#8

Subtask #8736 added

SB Updated by Shivani Bhardwaj about 1 month ago · Edited Actions
Copy link
#9

Hi @stu4rt ! Could you please tell your expectations regarding "dcerpc.flags" being a sticky keyword? I was going to implement it as an integer like "tcp.flags" but checked this description before to get an idea of what's needed. Stringified names for flags can also be made available.

SD Updated by Stuart DC about 1 month ago 1Actions
Copy link
#10

Shivani Bhardwaj wrote in #note-9:

Hi @stu4rt ! Could you please tell your expectations regarding "dcerpc.flags" being a sticky keyword? I was going to implement it as an integer like "tcp.flags" but checked this description before to get an idea of what's needed. Stringified names for flags can also be made available.

@Shivani Bhardwaj If dcerpc.flags is implemented similarly as tcp.flags, i think that would be great. it doesn't need to be a sticky buffer for my needs.

SB Updated by Shivani Bhardwaj 11 days ago Actions
Copy link
#11

Hi @stu4rt !

Apologies for being late. Another question has come up while implementing the support for these keywords. As a rule writer, do you expect say dcerpc.flags to match on a single PDU or say the result of reassembled PDUs in case they were fragmented?

Thanks a lot!

Actions

Copy link

Also available in: PDF Atom

Project

General

Profile

Suricata

Custom queries

Task #8692

tracking: detect: DCERPC keywords coverage

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#1

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#2

VJ Updated by Victor Julien about 2 months ago Actions
Copy link
#3

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#4

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#5

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#6

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#7

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#8

SB Updated by Shivani Bhardwaj about 1 month ago · Edited Actions
Copy link
#9

SD Updated by Stuart DC about 1 month ago 1Actions
Copy link
#10

SB Updated by Shivani Bhardwaj 11 days ago Actions
Copy link
#11

Project

General

Profile

Suricata

Custom queries

Task #8692

tracking: detect: DCERPC keywords coverage

LS Updated by Lukas Sismis 2 months ago ActionsCopy link #1

LS Updated by Lukas Sismis 2 months ago ActionsCopy link #2

VJ Updated by Victor Julien about 2 months ago ActionsCopy link #3

SB Updated by Shivani Bhardwaj about 2 months ago ActionsCopy link #4

SB Updated by Shivani Bhardwaj about 2 months ago ActionsCopy link #5

SB Updated by Shivani Bhardwaj about 2 months ago ActionsCopy link #6

SB Updated by Shivani Bhardwaj about 2 months ago ActionsCopy link #7

SB Updated by Shivani Bhardwaj about 2 months ago ActionsCopy link #8

SB Updated by Shivani Bhardwaj about 1 month ago · Edited ActionsCopy link #9

SD Updated by Stuart DC about 1 month ago 1ActionsCopy link #10

SB Updated by Shivani Bhardwaj 11 days ago ActionsCopy link #11

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#1

LS Updated by Lukas Sismis 2 months ago Actions
Copy link
#2

VJ Updated by Victor Julien about 2 months ago Actions
Copy link
#3

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#4

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#5

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#6

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#7

SB Updated by Shivani Bhardwaj about 2 months ago Actions
Copy link
#8

SB Updated by Shivani Bhardwaj about 1 month ago · Edited Actions
Copy link
#9

SD Updated by Stuart DC about 1 month ago 1Actions
Copy link
#10

SB Updated by Shivani Bhardwaj 11 days ago Actions
Copy link
#11