Project

General

Profile

Actions
Copy link

Feature #8749

open
PM OD

smb: add rule keyword support for status matches

Feature #8749: smb: add rule keyword support for status matches

Added by Peter Manev 4 months ago. Updated 2 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Being able to much in a signature on the status code in SMB sessions is very useful for detection.
For example many "access denied" status in a short period of time form the same source can indicate brute forcing/scanning and other lateral movement attempts.

The status field is already available in event_type:smb protocol logs however it can not be used as a matching keyword in a rule.

STATUS_ACCESS_DENIED
STATUS_LOGON_FAILURE
STATUS_ACCOUNT_DISABLED
STATUS_ACCOUNT_LOCKED_OUT
STATUS_PASSWORD_EXPIRED
STATUS_WRONG_PASSWORD

SB Updated by Shivani Bhardwaj 4 months ago Actions
Copy link
 #1

  • Status changed from New to Triaged
  • Assignee set to OISF Dev

LS Updated by Lukas Sismis 2 days ago Actions
Copy link
 #2

  • Target version changed from 9.0.0 to 9.0.0-beta1
Actions
Copy link

Also available in: PDF Atom