mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
5721db4be7
- It works with DCE/RPC over SMB1+2 now. - Using named pipes in 1+2 and the transaction cmd in SMB1. - Base scripts based on work by Josh Liburdi. - New dce_rpc.log. Feedback on how to make this log more compact and useful would be appreciated.
6 lines
No EOL
103 B
Standard ML
6 lines
No EOL
103 B
Standard ML
|
|
signature dpd_dce_rpc {
|
|
ip-proto == tcp
|
|
payload /^\x05[\x00\x01][\x00-\x13]\x03/
|
|
enable "DCE_RPC"
|
|
} |