SMBv3 Negotiate Protocol Response with Compression Capabilities Context
This alert is triggered when detecting an SMBv3 data compression response communication. SMBv3 is a network protocol used to provide shared access to files, printers, and other communication on a network. Data compression is the process of reducing the size of data files for storage by finding and eliminating redundancy in data. This alert may be triggered when an adversary is attempting to exploit a vulnerability in the SMBv3 Data compression process.
ID Number
1000022
Signature
alert tcp any 445 -> any any (msg:"SMBv3 Negotiate Protocol Reponse with Compression Capabilities Context"; content:"|fe 53 4d 42|"; offset: 4; depth: 10; content:"|00 00 00 00 00 00|"; distance: 4; content:"|11 03|"; distance: 50; within: 8; content:"|03 00 |"; distance: 64; within:400; content:"|00 00 00 00 00 |"; distance: 1; content:"|00 00 00 00 00 |"; distance: 1; sid:1000022; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
It is recommended to check if SMBv3 Data compression is permitted in the network. If the organization's policy permits such traffic, you can either disable the rule or establish a baseline.