Home Explore Help
Sign In
pandora-research
/
suricata
Watch 1
Star 0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: master
Branches Tags
suricata
/
rules
/
smb-events.rules

smb-events.rules 4.2 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445 
  1. # SMB app layer event rules
    2. 

  2. #
    3. 

  3. # SID's fall in the 2225000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
    4. 

  4. #
    5. 

  5. # These sigs fire at most once per connection.
    6. 

  6. #
    7. 

  7. 

  8. alert smb any any -> any any (msg:"SURICATA SMB internal parser error"; flow:to_server; app-layer-event:smb.internal_error; classtype:protocol-command-decode; sid:2225000; rev:1;)
    9. 

  9. alert smb any any -> any any (msg:"SURICATA SMB internal parser error"; flow:to_client; app-layer-event:smb.internal_error; classtype:protocol-command-decode; sid:2225001; rev:1;)
    10. 

  10. 

  11. alert smb any any -> any any (msg:"SURICATA SMB malformed request data"; flow:to_server; app-layer-event:smb.malformed_data; classtype:protocol-command-decode; sid:2225002; rev:1;)
    12. 

  12. alert smb any any -> any any (msg:"SURICATA SMB malformed response data"; flow:to_client; app-layer-event:smb.malformed_data; classtype:protocol-command-decode; sid:2225003; rev:1;)
    13. 

  13. 

  14. alert smb any any -> any any (msg:"SURICATA SMB malformed NTLMSSP record"; flow:to_server; app-layer-event:smb.malformed_ntlmssp_request; classtype:protocol-command-decode; sid:2225004; rev:1;)
    15. 

  15. 

  16. alert smb any any -> any any (msg:"SURICATA SMB malformed request dialects"; flow:to_server; app-layer-event:smb.negotiate_malformed_dialects; classtype:protocol-command-decode; sid:2225005; rev:1;)
    17. 

  17. 

  18. alert smb any any -> any any (msg:"SURICATA SMB file overlap"; app-layer-event:smb.file_overlap; classtype:protocol-command-decode; sid:2225006; rev:1;)
    19. 

  19. alert smb any any -> any any (msg:"SURICATA SMB wrong direction"; app-layer-event:smb.response_to_server; classtype:protocol-command-decode; sid:2225007; rev:1;)
    20. 

  20. alert smb any any -> any any (msg:"SURICATA SMB wrong direction"; app-layer-event:smb.request_to_client; classtype:protocol-command-decode; sid:2225008; rev:1;)
    21. 

  21. 

  22. # checks negotiated max-read-size and 'app-layer.protocols.smb.max-read-size`
    23. 

  23. alert smb any any -> any any (msg:"SURICATA SMB max requested READ size exceeded"; flow:to_server; app-layer-event:smb.read_request_too_large; classtype:protocol-command-decode; sid:2225009; rev:1;)
    24. 

  24. # checks negotiated max-read-size and 'app-layer.protocols.smb.max-read-size`
    25. 

  25. alert smb any any -> any any (msg:"SURICATA SMB max response READ size exceeded"; flow:to_client; app-layer-event:smb.read_response_too_large; classtype:protocol-command-decode; sid:2225010; rev:1;)
    26. 

  26. # checks negotiated max-write-size and 'app-layer.protocols.smb.max-write-size`
    27. 

  27. alert smb any any -> any any (msg:"SURICATA SMB max WRITE size exceeded"; flow:to_server; app-layer-event:smb.write_request_too_large; classtype:protocol-command-decode; sid:2225011; rev:1;)
    28. 

  28. 

  29. # checks 'app-layer.protocols.smb.max-read-size` against NEGOTIATE PROTOCOL response
    30. 

  30. alert smb any any -> any any (msg:"SURICATA SMB supported READ size exceeded"; flow:to_client; app-layer-event:smb.negotiate_max_read_size_too_large; classtype:protocol-command-decode; sid:2225012; rev:1;)
    31. 

  31. # checks 'app-layer.protocols.smb.max-write-size` against NEGOTIATE PROTOCOL response
    32. 

  32. alert smb any any -> any any (msg:"SURICATA SMB supported WRITE size exceeded"; flow:to_server; app-layer-event:smb.negotiate_max_write_size_too_large; classtype:protocol-command-decode; sid:2225013; rev:1;)
    33. 

  33. 

  34. # checks 'app-layer.protocols.smb.max-write-queue-size` against out of order chunks
    35. 

  35. alert smb any any -> any any (msg:"SURICATA SMB max WRITE queue size exceeded"; flow:to_server; app-layer-event:smb.write_queue_size_exceeded; classtype:protocol-command-decode; sid:2225014; rev:1;)
    36. 

  36. # checks 'app-layer.protocols.smb.max-write-queue-cnt` against out of order chunks
    37. 

  37. alert smb any any -> any any (msg:"SURICATA SMB max WRITE queue cnt exceeded"; flow:to_server; app-layer-event:smb.write_queue_cnt_exceeded; classtype:protocol-command-decode; sid:2225015; rev:1;)
    38. 

  38. 

  39. # checks 'app-layer.protocols.smb.max-read-queue-size` against out of order chunks
    40. 

  40. alert smb any any -> any any (msg:"SURICATA SMB max READ queue size exceeded"; flow:to_client; app-layer-event:smb.read_queue_size_exceeded; classtype:protocol-command-decode; sid:2225016; rev:1;)
    41. 

  41. # checks 'app-layer.protocols.smb.max-read-queue-cnt` against out of order chunks
    42. 

  42. alert smb any any -> any any (msg:"SURICATA SMB max READ queue cnt exceeded"; flow:to_client; app-layer-event:smb.read_queue_cnt_exceeded; classtype:protocol-command-decode; sid:2225017; rev:1;)
    43. 

  43. 

  44. # next sid 2225018
    45. 

  45.