Suricata

Being able to much in a signature on the actual command in SMB sessions is also very useful for detection.
Certain sequences detection can be greatly improved bu sing a flow that has specific sets of commands.

The command field is already available in event_type:smb protocol logs however it can not be used as a matching keyword in a rule currently.

smb.command
SMB2_COMMAND_CREATE
SMB2_COMMAND_CLOSE
SMB2_COMMAND_FIND
SMB2_COMMAND_READ
SMB2_COMMAND_IOCTL
SMB2_COMMAND_SESSION_SETUP
SMB2_COMMAND_NEGOTIATE_PROTOCOL
SMB2_COMMAND_TREE_CONNECT
SMB2_COMMAND_TREE_DISCONNECT
SMB1_COMMAND_NEGOTIATE_PROTOCOL
SMB2_COMMAND_SESSION_LOGOFF
SMB2_COMMAND_WRITE
SMB1_COMMAND_NT_TRANS
SMB1_COMMAND_NT_TRANS_SECONDARY
SMB1_COMMAND_TREE_CONNECT_ANDX
SMB1_COMMAND_NT_CREATE_ANDX
SMB1_COMMAND_TREE_DISCONNECT
SMB1_COMMAND_SESSION_SETUP_ANDX
SMB1_COMMAND_CLOSE
SMB1_COMMAND_TRANS2_SECONDARY
SMB1_COMMAND_WRITE_ANDX
SMB1_COMMAND_LOGOFF_ANDX
SMB1_COMMAND_ECHO
SMB2_COMMAND_SET_INFO
SMB2_COMMAND_OPLOCK_BREAK
SMB1_COMMAND_READ_ANDX
SMB2_COMMAND_FLUSH
SMB2_COMMAND_CHANGE_NOTIFY
SMB2_COMMAND_CANCEL
SMB1_COMMAND_LOCKING_ANDX