Feature #8762: dcerpc: record unhandled PDU types - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #8762

open

SB SB

Task #8692: tracking: detect: DCERPC keywords coverage

Feature #8733: detect: rule keyword for dcerpc.ptype

dcerpc: record unhandled PDU types

Feature #8762: dcerpc: record unhandled PDU types

Added by Shivani Bhardwaj 21 days ago. Updated 20 days ago.

Status:

In Review

Priority:

Normal

Assignee:

Shivani Bhardwaj

Target version:

9.0.0-beta1

Effort:

Difficulty:

low

Label:

Description

DCERPC parser only handles and logs 3 types of request/response pairs:
1. REQUEST/RESPONSE
2. BIND/BIND_ACK
3. ALTER_CONTEXT/ALTER_CONTEXT_RESP

All the other unhandled types that are parsed from the header are not even logged/available for matching through keywords like dcerpc.ptype. DCERPC parser should create a record of these PDU types and allow for matching on the header fields at least even if it cannot handle the rest of the fragment.