base/bif/plugins/Bro_SMB.events.bif.bro

GLOBAL
Namespace:GLOBAL
Source File:/scripts/base/bif/plugins/Bro_SMB.events.bif.bro

Summary

Events

smb_com_close: event Generated for SMB/CIFS messages of type close.
smb_com_generic_andx: event Generated for SMB/CIFS messages of type generic andx.
smb_com_logoff_andx: event Generated for SMB/CIFS messages of type logoff andx.
smb_com_negotiate: event Generated for SMB/CIFS messages of type negotiate.
smb_com_negotiate_response: event Generated for SMB/CIFS messages of type negotiate response.
smb_com_nt_create_andx: event Generated for SMB/CIFS messages of type nt create andx.
smb_com_read_andx: event Generated for SMB/CIFS messages of type read andx.
smb_com_setup_andx: event Generated for SMB/CIFS messages of type setup andx.
smb_com_trans_mailslot: event Generated for SMB/CIFS messages of type transaction mailslot.
smb_com_trans_pipe: event Generated for SMB/CIFS messages of type transaction pipe.
smb_com_trans_rap: event Generated for SMB/CIFS messages of type transaction rap.
smb_com_transaction: event Generated for SMB/CIFS messages of type nt transaction.
smb_com_transaction2: event Generated for SMB/CIFS messages of type nt transaction 2.
smb_com_tree_connect_andx: event Generated for SMB/CIFS messages of type tree connect andx.
smb_com_tree_disconnect: event Generated for SMB/CIFS messages of type tree disconnect.
smb_com_write_andx: event Generated for SMB/CIFS messages of type read andx.
smb_error: event Generated for SMB/CIFS messages that indicate an error.
smb_get_dfs_referral: event Generated for SMB/CIFS messages of type get dfs referral.
smb_message: event Generated for all SMB/CIFS messages.

Detailed Interface

Events

smb_com_close
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type close.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_generic_andx
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type generic andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_close, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_logoff_andx
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type logoff andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_close, smb_com_generic_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_negotiate
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type negotiate.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_negotiate_response
Type:event (c: connection, hdr: smb_hdr, dialect_index: count)

Generated for SMB/CIFS messages of type negotiate response.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Dialect_index:The dialect indicated in the message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_nt_create_andx
Type:event (c: connection, hdr: smb_hdr, name: string)

Generated for SMB/CIFS messages of type nt create andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Name:The name attribute specified in the message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_read_andx
Type:event (c: connection, hdr: smb_hdr, data: string)

Generated for SMB/CIFS messages of type read andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Data:Always empty.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_setup_andx
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type setup andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_trans_mailslot
Type:event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool)

Generated for SMB/CIFS messages of type transaction mailslot.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Trans:The parsed transaction header.
Data:The raw transaction data.
Is_orig:True if the message was sent by the originator of the connection.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_trans_pipe
Type:event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool)

Generated for SMB/CIFS messages of type transaction pipe.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Trans:The parsed transaction header.
Data:The raw transaction data.
Is_orig:True if the message was sent by the originator of the connection.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_trans_rap
Type:event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool)

Generated for SMB/CIFS messages of type transaction rap.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Trans:The parsed transaction header.
Data:The raw transaction data.
Is_orig:True if the message was sent by the originator of the connection.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_transaction
Type:event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool)

Generated for SMB/CIFS messages of type nt transaction.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Trans:The parsed transaction header.
Data:The raw transaction data.
Is_orig:True if the message was sent by the originator of the connection.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_transaction2
Type:event (c: connection, hdr: smb_hdr, trans: smb_trans, data: smb_trans_data, is_orig: bool)

Generated for SMB/CIFS messages of type nt transaction 2.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Trans:The parsed transaction header.
Data:The raw transaction data.
Is_orig:True if the message was sent by the originator of the connection.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_tree_connect_andx
Type:event (c: connection, hdr: smb_hdr, path: string, service: string)

Generated for SMB/CIFS messages of type tree connect andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Path:The path attribute specified in the message.
Service:The service attribute specified in the message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_tree_disconnect
Type:event (c: connection, hdr: smb_hdr)

Generated for SMB/CIFS messages of type tree disconnect.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_write_andx, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_com_write_andx
Type:event (c: connection, hdr: smb_hdr, data: string)

Generated for SMB/CIFS messages of type read andx.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Data:Always empty.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_error, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_error
Type:event (c: connection, hdr: smb_hdr, cmd: count, cmd_str: string, data: string)

Generated for SMB/CIFS messages that indicate an error. This event is triggered by an SMB header including a status that signals an error.

C:The connection.
Hdr:The parsed header of the SMB message.
Cmd:The SMB command code.
Cmd_str:A string mnemonic of the SMB command code.
Data:The raw SMB message body, i.e., the data starting after the SMB header.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_get_dfs_referral, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_get_dfs_referral
Type:event (c: connection, hdr: smb_hdr, max_referral_level: count, file_name: string)

Generated for SMB/CIFS messages of type get dfs referral.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Max_referral_level:
 The max_referral_level attribute specified in the message.
File_name:The filene_name attribute specified in the message.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_message

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.

smb_message
Type:event (c: connection, hdr: smb_hdr, is_orig: bool, cmd: string, body_length: count, body: string)

Generated for all SMB/CIFS messages.

See Wikipedia for more information about the SMB/CIFS protocol. Bro’s SMB/CIFS analyzer parses both SMB-over-NetBIOS on ports 138/139 and SMB-over-TCP on port 445.

C:The connection.
Hdr:The parsed header of the SMB message.
Is_orig:True if the message was sent by the originator of the underlying transport-level connection.
Cmd:A string mnemonic of the SMB command code.
Body_length:The length of the SMB message body, i.e. the data starting after the SMB header.
Body:The raw SMB message body, i.e., the data starting after the SMB header.

See also: smb_com_close, smb_com_generic_andx, smb_com_logoff_andx, smb_com_negotiate, smb_com_negotiate_response, smb_com_nt_create_andx, smb_com_read_andx, smb_com_setup_andx, smb_com_trans_mailslot, smb_com_trans_pipe, smb_com_trans_rap, smb_com_transaction, smb_com_transaction2, smb_com_tree_connect_andx, smb_com_tree_disconnect, smb_com_write_andx, smb_error, smb_get_dfs_referral

Todo

Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.


Copyright 2013, The Bro Project. Last updated on July 19, 2016. Created using Sphinx 1.4.4.