Suricata

Suricata does not currently recognize the wkssvc and netlogon SMB named pipes as DCE/RPC transports.

Although the SMB parser detects these pipe names in SMB2_COMMAND_CREATE, the data transferred through them is not passed to the DCE/RPC parser. Therefore, detection rules that rely on DCE/RPC inspection do not work for traffic carried over these pipes.

In particular, rules using the following keywords cannot match:

• dcerpc.iface
• dcerpc.opnum
• dcerpc.stub_data

The absence of dcerpc fields in eve.json is another observable result of the same issue. DCE/RPC binds, interface UUIDs, operation numbers, requests and responses are not parsed.

Required change¶

The named-pipe classification logic is located in:

rust/src/smb/smb.rs

In the match statement that maps an SMB pipe name to a service name and marks it as carrying DCE/RPC traffic, add case-insensitive handling for the following pipes:

• wkssvc
• netlogon

For example:

Ok(name) if name.eq_ignore_ascii_case("wkssvc") => ("wkssvc", true),
Ok(name) if name.eq_ignore_ascii_case("netlogon") => ("netlogon", true),

These entries can be added next to the existing recognized DCE/RPC pipes, such as winreg.

Case-insensitive matching is required because pipe names may appear with different capitalization, for example wkssvc and NETLOGON.

After this change, Suricata should classify both pipes as DCE/RPC transports and pass their contents to the DCE/RPC parser. This makes DCE/RPC fields available to the detection engine, allows rules using dcerpc.* keywords to work, and includes the parsed information in eve.json.

Attached files¶

• eve_wkssvc.json — unmodified parser; DCE/RPC over wkssvc is not recognized.
• eve_wkssvc_fixed.json — modified parser; DCE/RPC over wkssvc is recognized.
• eve_netlogon.json — unmodified parser; DCE/RPC over netlogon is not recognized.
• eve_netlogon_fixed.json — modified parser; DCE/RPC over netlogon is recognized.