admin/Paradoxis-DNSRPC-BOF
1
0
Fork 0
mirror of https://github.com/Paradoxis/DNSRPC-BOF synced 2026-08-09 12:17:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2 from Paradoxis/bug/fix-pcaps-polish-rules

Browse Source 
Bug/fix pcaps polish rules
This commit is contained in:
Luke Paris
2026-07-03 13:13:45 +02:00
committed by GitHub
parent 687ee6851b 1d17e37de4
commit 74da3728d8
5 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pcaps/dnsrpc.rules
+7 -5
View File
@@ -1,6 +1,8 @@
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) restart request observed"; flow:established,to_server; content:"|05 00 00|"; offset:0; depth:3; content:"|05 00|"; offset:22; depth:2; content:"Restart"; distance:0; nocase; fast_pattern; classtype:attempted-admin; priority:1; sid:1000010; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) ServerLevelPluginDll configuration change request observed"; flow:established,to_server; content:"|05 00 00|"; offset:0; depth:3; content:"|05 00|"; offset:22; depth:2; content:"ServerLevelPluginDll"; distance:0; nocase; fast_pattern; classtype:attempted-admin; priority:1; sid:1000020; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) ServerInfo enumeration request observed"; flow:established,to_server; content:"|05 00 00|"; offset:0; depth:3; content:"|06 00|"; offset:22; depth:2; content:"ServerInfo"; distance:0; nocase; fast_pattern; classtype:attempted-recon; priority:2; sid:1000030; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) LogFilePath+ClearDebugLog coercion request observed 1/2"; flow:established,to_server; content:"|05 00 00|"; offset:0; depth:3; content:"|05 00|"; offset:22; depth:2; content:"LogFilePath"; distance:0; nocase; fast_pattern; within:400; content:"|5c 00 5c 00|"; distance:0; within:50; flowbits:set,dnsrpc.logfilepath_call; flowbits:noalert; classtype:misc-attack; priority:3; sid:1000040; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) LogFilePath+ClearDebugLog coercion request observed 2/2"; flow:established,to_server; flowbits:isset,dnsrpc.logfilepath_call; content:"|05 00 00|"; offset:0; depth:3; content:"|05 00|"; offset:22; depth:2; content:"ClearDebugLog"; distance:0; nocase; fast_pattern; classtype:misc-attack; priority:1; sid:1000041; rev:1;)
# Set a flowbit on the bind of the DNSSERVER UUID request, use this for every subsequent request that is being made
alert tcp any any -> any any (msg:"MRLN-SRT - DCERPC DNSSERVER Bind Request Flowbit"; flow:established,to_server; content:"|05 00 0b|"; offset:0; depth:3; content:"|a4 c2 ab 50 4d 57 b3 40 9d 66 ee 4f d5 fb a0 76|"; offset:32; depth:16; fast_pattern; flowbits:set,dcerpc.dnsserver_bind; flowbits:noalert; threshold:type limit,track by_src,count 1,seconds 600; classtype:not-suspicious; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:3; sid:1000009; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) restart request observed"; flow:established,to_server; flowbits:isset,dcerpc.dnsserver_bind; content:"|05 00 00 03|"; offset:0; depth:4; content:"|05 00|"; distance:18; within:2; content:"Restart"; distance:0; nocase; fast_pattern; threshold:type limit,track by_src,count 1,seconds 600; classtype:attempted-admin; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:1; sid:1000010; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) ServerLevelPluginDll configuration change request observed"; flow:established,to_server; flowbits:isset,dcerpc.dnsserver_bind; content:"|05 00 00 03|"; offset:0; depth:4; content:"|05 00|"; distance:18; within:2; content:"ServerLevelPluginDll"; distance:0; nocase; fast_pattern; threshold:type limit,track by_src,count 1,seconds 600; classtype:attempted-admin; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:1; sid:1000011; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) ServerInfo enumeration request observed"; flow:established,to_server; flowbits:isset,dcerpc.dnsserver_bind; content:"|05 00 00 03|"; offset:0; depth:4; content:"|06 00|"; distance:18; within:2; content:"ServerInfo"; distance:0; nocase; fast_pattern; threshold:type limit,track by_src,count 1,seconds 600; classtype:attempted-recon; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:2; sid:1000012; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) LogFilePath+ClearDebugLog coercion request observed 1/2"; flow:established,to_server; flowbits:isset,dcerpc.dnsserver_bind; content:"|05 00 00 03|"; offset:0; depth:4; content:"|05 00|"; distance:18; within:2; content:"LogFilePath"; distance:0; nocase; fast_pattern; within:400; content:"|5c 00 5c 00|"; distance:0; within:50; flowbits:set,dnsrpc.logfilepath_call; flowbits:noalert; classtype:misc-attack; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:3; sid:1000013; rev:1;)
alert tcp any any -> any any (msg:"MRLN-SRT - Suspicious MS-DNSP (ADIDNS RPC) LogFilePath+ClearDebugLog coercion request observed 2/2"; flow:established,to_server; flowbits:isset,dnsrpc.logfilepath_call; content:"|05 00 00 03|"; offset:0; depth:4; content:"|05 00|"; distance:18; within:2; content:"ClearDebugLog"; distance:0; nocase; fast_pattern; threshold:type limit,track by_src,count 1,seconds 600; classtype:misc-attack; reference:url, https://github.com/Paradoxis/DNSRPC-BOF/tree/main; priority:1; sid:1000014; rev:1;)
pcaps/dnsrpc_coerce_write.pcap
BIN
View File
Binary file not shown.
pcaps/dnsrpc_info.pcap
BIN
View File
Binary file not shown.
pcaps/dnsrpc_restart.pcap
BIN
View File
Binary file not shown.
pcaps/dnsrpc_set_plugin_dll.pcap
BIN
View File
Binary file not shown.