About Alex_S

Hello, I'm trying to write a custom smb signature to restrict access to certain shares. It's based on Custom App-ID for a specific SMB share My share pattern is '\\america\credit'. Unfortunately, it didn't work for me and I opened a support case. But they asked me to post the sig. here to verify it first before they look at this further. Can some one please, check the signature ? <application version="5.1.0">   <entry name="smb-myshare">     <signature>       <entry name="s1">         <and-condition>           <entry name="And Condition 2">             <or-condition>               <entry name="Or Condition 1">                 <operator>                   <pattern-match>                     <pattern>\x 5c 00 5c 00 61 00 6d 00 65 00 72 00 69 00 63 00 61 00 5c 00 63 00 72 00 65 00 64 00 69 00 74 00\x</pattern>                     <context>ms-ds-smb-req-share-name</context>                   </pattern-match>                 </operator>               </entry>             </or-condition>           </entry>         </and-condition>         <scope>protocol-data-unit</scope>         <order-free>no</order-free>         <comment>string in unicode matches "\\america\credit"</comment>       </entry>     </signature>     <subcategory>storage-backup</subcategory>     <category>business-systems</category>     <technology>client-server</technology>     <risk>3</risk>     <evasive-behavior>no</evasive-behavior>     <consume-big-bandwidth>no</consume-big-bandwidth>     <used-by-malware>no</used-by-malware>     <able-to-transfer-file>yes</able-to-transfer-file>     <has-known-vulnerability>yes</has-known-vulnerability>     <tunnel-other-application>no</tunnel-other-application>     <tunnel-applications>no</tunnel-applications>     <prone-to-misuse>no</prone-to-misuse>     <pervasive-use>no</pervasive-use>     <file-type-ident>yes</file-type-ident>     <virus-ident>yes</virus-ident>     <spyware-ident>no</spyware-ident>     <data-ident>no</data-ident>     <parent-app>ms-ds-smb</parent-app>     <description>App-ID to identify and control access to a specific SMB share</description>     <default>       <port>         <member>tcp/445</member>         <member>udp/445</member>         <member>tcp/139</member>       </port>     </default>   </entry> </application> Thanks, Alex ... View more