Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
12374 commits 386 branches 195 tags 257 MiB
Commit graph

55 commits

Author SHA1 Message Date
Seth Hall
dbb4404b7d Improve DCE_RPC logging reliability. 2016-04-01 16:53:17 -04:00
Seth Hall
b1f8f0c099 Improvements for DCE_RPC 
- Binding context versions are provided correctly now.
 - RPC stubs are no longer provided and instead only the length is given.
 - Some parsing problems related to handling the optional
   auth fields in RPC messages are fixed.  This removes some
   dpd log messages I was seeing.
 2016-04-01 14:48:07 -04:00
Seth Hall
03d5b655af Add epmapper operations to dce_rpc scripts. 2016-04-01 13:01:23 -04:00
Seth Hall
086519e851 Adding more dcerpc operations and fixing a bug with how log records are handled. 2016-04-01 10:16:02 -04:00
Seth Hall
5721db4be7 Lots of cleanup and improvement to DCE/RPC analyzer. 
- It works with DCE/RPC over SMB1+2 now.
   - Using named pipes in 1+2 and the transaction cmd in SMB1.
 - Base scripts based on work by Josh Liburdi.
 - New dce_rpc.log.  Feedback on how to make this log more compact
   and useful would be appreciated.
 2016-04-01 09:38:52 -04:00