POLICY-OTHER SunRPC Portmap GETPORT request detected
The rule is designed to trigger an alert when it detects a SunRPC Portmap GETPORT request in the network traffic. The specific content pattern in the rule corresponds to the GETPORT request for the SunRPC Portmap service.
ID Number
41185
Signature
alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"POLICY-OTHER SunRPC Portmap GETPORT request detected"; flow:to_server,established; content:"|00 00 00 00 00 00 00 02 00 01 86 A0 00 00 00 02 00 00 00 03|"; depth:20; offset:8; metadata:policy max-detect-ips drop, policy security-ips drop, service sunrpc; reference:url,en.wikipedia.org/wiki/Portmap; classtype:policy-violation; sid:41185; rev:4;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved - archive and baseline the rule. If not - check the connection and investigate the file and the relevant IP address.