Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'topic/ak/rdpeudp'

Browse source 
- Squashed the original commit set
- Cleaned up formatting
- Fixed register_for_ports() for right RDPEUDP analyzer

* topic/ak/rdpeudp:
  Add RDP over UDP analyzer
This commit is contained in:
Jon Siwek 2020-04-02 18:29:23 -07:00
commit e66148a13a
25 changed files with 585 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/rdp/dpd.sig
View file

@ -10,3 +10,12 @@ signature dpd_rdp_server {
ip-proto == tcp
payload /(.{5}\xd0|.*McDn)/
}
signature dpd_rdpeudp_syn {
ip-proto == udp
payload-size <= 1232
payload-size >= 1132
payload /^\xff{4}.{2}.{1}\x01/
enable "rdpeudp"
}

8
scripts/base/protocols/rdp/main.zeek
View file

@ -85,13 +85,15 @@ redef record connection += {
rdp: Info &optional;
};
const ports = { 3389/tcp };
redef likely_server_ports += { ports };
const rdp_ports = { 3389/tcp };
const rdpeudp_ports = { 3389/udp };
redef likely_server_ports += { rdp_ports, rdpeudp_ports };
event zeek_init() &priority=5
{
Log::create_stream(RDP::LOG, [$columns=RDP::Info, $ev=log_rdp, $path="rdp"]);
Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, ports);
Analyzer::register_for_ports(Analyzer::ANALYZER_RDP, rdp_ports);
Analyzer::register_for_ports(Analyzer::ANALYZER_RDPEUDP, rdpeudp_ports);
}
function write_log(c: connection)