Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
MS-RPC:EVASION:DCERPC-SMALL-REQ |
|---|---|
Severity |
Major |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
MS-RPC |
Release Date |
2010/10/22 |
Update Number |
1796 |
Supported Platforms |
idp-4.1.110110609+, isg-3.4.139899+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
MS-RPC: Evasion Technique (7a)
This anomaly triggers when it detects packets containing known evasion techniques that affect the SMB, DCE RPC, and MS RPC protocols. These packets should not be seen in normal traffic and indicate attempts to evade network defense systems by sending invalid, out of order, or heavily fragmented communication. Due to potential false-positives in some older MS-RPC services, this anomaly should only be used to inspect traffic going to and from the Internet on WAN links. This anomaly should NOT be used to monitor traffic between internal servers/clients on a LAN or inter-office WAN.