Custom App-ID SMB Signature Assistance

[Alex_S]

Hello,

I'm trying to write a custom smb signature to restrict access to certain shares. It's based on Custom App-ID for a specific SMB share

My share pattern is '\\america\credit'. Unfortunately, it didn't work for me and I opened a support case. But they asked me to post the sig. here to verify it first before they look at this further. Can some one please, check the signature ?

<application version="5.1.0">

  <entry name="smb-myshare">

    <signature>

      <entry name="s1">

        <and-condition>

          <entry name="And Condition 2">

            <or-condition>

              <entry name="Or Condition 1">

                <operator>

                  <pattern-match>

                    <pattern>\x 5c 00 5c 00 61 00 6d 00 65 00 72 00 69 00 63 00 61 00 5c 00 63 00 72 00 65 00 64 00 69 00 74 00\x</pattern>

                    <context>ms-ds-smb-req-share-name</context>

                  </pattern-match>

                </operator>

              </entry>

            </or-condition>

          </entry>

        </and-condition>

        <scope>protocol-data-unit</scope>

        <order-free>no</order-free>

        <comment>string in unicode matches "\\america\credit"</comment>

      </entry>

    </signature>

    <subcategory>storage-backup</subcategory>

    <category>business-systems</category>

    <technology>client-server</technology>

    <risk>3</risk>

    <evasive-behavior>no</evasive-behavior>

    <consume-big-bandwidth>no</consume-big-bandwidth>

    <used-by-malware>no</used-by-malware>

    <able-to-transfer-file>yes</able-to-transfer-file>

    <has-known-vulnerability>yes</has-known-vulnerability>

    <tunnel-other-application>no</tunnel-other-application>

    <tunnel-applications>no</tunnel-applications>

    <prone-to-misuse>no</prone-to-misuse>

    <pervasive-use>no</pervasive-use>

    <file-type-ident>yes</file-type-ident>

    <virus-ident>yes</virus-ident>

    <spyware-ident>no</spyware-ident>

    <data-ident>no</data-ident>

    <parent-app>ms-ds-smb</parent-app>

    <description>App-ID to identify and control access to a specific SMB share</description>

    <default>

      <port>

        <member>tcp/445</member>

        <member>udp/445</member>

        <member>tcp/139</member>

      </port>

    </default>

  </entry>

</application>

Thanks,

Alex

[bpappas]

I think you want to remove the <or-condition> as that will make the entry contained inside that tag optional. as i read it the signature would fire on all traffic, not just the path you want to match.

[gwesson]

Looking at a packet capture, the raw hex stream doesn't include spaces. So yours would be:

\x5C005C0061006D006500720069006300\x

I haven't tested this, but it may be worth a shot. I know the article linked shows spaces, but that seems odd to me because the pattern is specifying hex (using \x in front and back). Might be worth trying.

-Greg

[Alex_S]

Sorry for the late post. Thank you Greg, I'll give it a shot.

Alex