Project

General

Profile

Actions
Copy link

Feature #8762

open
SB SB

Task #8692: tracking: detect: DCERPC keywords coverage

Feature #8733: detect: rule keyword for dcerpc.ptype

dcerpc: record unhandled PDU types

Feature #8762: dcerpc: record unhandled PDU types

Added by Shivani Bhardwaj about 13 hours ago. Updated about 12 hours ago.

Status:
Assigned
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
9.0.0-beta1
Effort:
Difficulty:
low
Label:

Description

DCERPC parser only handles and logs 3 types of request/response pairs:
1. REQUEST/RESPONSE
2. BIND/BIND_ACK
3. ALTER_CONTEXT/ALTER_CONTEXT_RESP

All the other unhandled types that are parsed from the header are not even logged/available for matching through keywords like dcerpc.ptype. DCERPC parser should create a record of these PDU types and allow for matching on the header fields at least even if it cannot handle the rest of the fragment.

SB Updated by Shivani Bhardwaj about 12 hours ago Actions
Copy link
 #1

  • Difficulty set to low

SB Updated by Shivani Bhardwaj about 12 hours ago Actions
Copy link
 #2

  • Parent task set to #8733
Actions
Copy link

Also available in: PDF Atom