mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
8ce6d67acc
This should reduce the ambiguity of where precisely the indicator was seen so that it isn't confused with the normal File::IN_NAME hit.
20 lines
No EOL
540 B
Text
20 lines
No EOL
540 B
Text
@load base/frameworks/intel
|
|
@load ./where-locations
|
|
|
|
event file_new(f: fa_file)
|
|
{
|
|
if ( f$source != "SMB" )
|
|
return;
|
|
|
|
for ( id in f$conns )
|
|
{
|
|
local c = f$conns[id];
|
|
if ( c?$smb_state && c$smb_state?$current_file && c$smb_state$current_file?$name )
|
|
{
|
|
Intel::seen([$indicator=c$smb_state$current_file$name,
|
|
$indicator_type=Intel::FILE_NAME,
|
|
$f=f,
|
|
$where=SMB::IN_FILE_NAME]);
|
|
}
|
|
}
|
|
} |