POLICY-OTHER SunRPC Portmap GETPORT request detected
The rule is designed to trigger an alert when it detects a SunRPC Portmap GETPORT request in the network traffic. The specific content pattern in the rule corresponds to the GETPORT request for the SunRPC Portmap service.
ID Number
41186
Signature
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"POLICY-OTHER SunRPC Portmap GETPORT request detected"; flow:to_server; content:"|00 00 00 00 00 00 00 02 00 01 86 A0 00 00 00 02 00 00 00 03|"; depth:20; offset:4; metadata:policy max-detect-ips drop, service sunrpc; reference:url,en.wikipedia.org/wiki/Portmap; classtype:policy-violation; sid:41186; rev:3;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved - archive and baseline the rule. If not - check the connection and investigate the file and the relevant IP address.