GPL NETBIOS SMB nddeapi unicode bind attempt

flow:established,to_server;
flowbits:isset,smb.tree.create.nddeapi;
content:"|00|"; depth:1;
content:"|FF|SMB%"; within:5; distance:3;
byte_test:1,&,128,6,relative;
content:"&|00|"; within:2; distance:56;
content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase;
byte_jump:2,-10,relative,from_beginning;
content:"|05|"; distance:4; within:1;
content:"|0B|"; within:1; distance:1;
content:" 2_/&|C1|v|10 B5|I|07|M|07 86 19 DA|"; within:16; distance:29;
flowbits:set,smb.tree.bind.nddeapi;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Suricata flowbits smb.tree.create.nddeapi
  • GPL NETBIOS SMB nddeapi create tree attempt
  • GPL NETBIOS SMB nddeapi unicode create tree attempt
  • GPL NETBIOS SMB-DS nddeapi create tree attempt
  • GPL NETBIOS SMB-DS nddeapi unicode create tree attempt
  • GPL NETBIOS SMB nddeapi andx create tree attempt
  • GPL NETBIOS SMB nddeapi unicode andx create tree attempt
  • GPL NETBIOS SMB-DS nddeapi andx create tree attempt
  • GPL NETBIOS SMB-DS nddeapi unicode andx create tree attempt

Feeds into

• 16 rules read smb.tree.bind.nddeapi · view all