Actions
Feature #8753
open
PM
smb: add rule keyword support for command matches
Feature #8753:
smb: add rule keyword support for command matches
Effort:
Difficulty:
Label:
Description
Being able to much in a signature on the actual command in SMB sessions is also very useful for detection.
Certain sequences detection can be greatly improved bu sing a flow that has specific sets of commands.
The command field is already available in event_type:smb protocol logs however it can not be used as a matching keyword in a rule currently.
smb.command SMB2_COMMAND_CREATE SMB2_COMMAND_CLOSE SMB2_COMMAND_FIND SMB2_COMMAND_READ SMB2_COMMAND_IOCTL SMB2_COMMAND_SESSION_SETUP SMB2_COMMAND_NEGOTIATE_PROTOCOL SMB2_COMMAND_TREE_CONNECT SMB2_COMMAND_TREE_DISCONNECT SMB1_COMMAND_NEGOTIATE_PROTOCOL SMB2_COMMAND_SESSION_LOGOFF SMB2_COMMAND_WRITE SMB1_COMMAND_NT_TRANS SMB1_COMMAND_NT_TRANS_SECONDARY SMB1_COMMAND_TREE_CONNECT_ANDX SMB1_COMMAND_NT_CREATE_ANDX SMB1_COMMAND_TREE_DISCONNECT SMB1_COMMAND_SESSION_SETUP_ANDX SMB1_COMMAND_CLOSE SMB1_COMMAND_TRANS2_SECONDARY SMB1_COMMAND_WRITE_ANDX SMB1_COMMAND_LOGOFF_ANDX SMB1_COMMAND_ECHO SMB2_COMMAND_SET_INFO SMB2_COMMAND_OPLOCK_BREAK SMB1_COMMAND_READ_ANDX SMB2_COMMAND_FLUSH SMB2_COMMAND_CHANGE_NOTIFY SMB2_COMMAND_CANCEL SMB1_COMMAND_LOCKING_ANDX
PM Updated by Peter Manev 3 days ago
- Tracker changed from Bug to Feature
- Target version changed from TBD to 9.0.0
- Affected Versions deleted (
9.0.0)
Actions