Signature Detail
Short Name |
SMB:AUDIT:DCERPC-UNEXPECTED-RSP |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
SMB |
Release Date |
2006/08/09 |
Update Number |
1213 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SMB: DCERPC Unexpected Response
This anomaly triggers when it detects packets containing known evasion techniques that affect the SMB, DCE, RPC, and MS RPC protocols. These packets are normally not seen in traffic and indicate attempts to evade network defense systems by sending invalid, out of order, or heavily fragmented communications. Use this signature only at WAN borders to reduce false positive possibilities.
Extended Description
None