<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal"><p dir="auto">The original idea was to get extensive parsing in place for DCE-RPC messages by parsing the IDL files for those services. Someone in the community had hoped to take it on, but hasn't had time yet to complete it. If you'd be interested in discussing that, I think that could be a huge addition to Bro (hundreds of new events!).</p>
<p dir="auto">The At service parsing file is still there because I didn't want to lose track of it but I think there was some slight architectural change that needed to happen before I could pass data to it. I don't think that data is even going to that parser, it's not just that there aren't events. I'd have to refer back to the code to see what exactly is wrong though.</p>
<p dir="auto">As for an approach to this problem right now, I'd prefer to see parsing done in the core. Architecturally we try to avoid passing unparsed data to Bro script land because of performance concerns and we generally don't have the intrinsic tools to be able to do parsing well in Bro scripts.</p>
<p dir="auto"> .Seth</p>
<p dir="auto">On 25 Jan 2018, at 12:28, Fernandez, Mark I wrote:</p>
</div>
<blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><div id="E930F140-FAD2-4B59-A86F-DD2464F731C8">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div style="page:WordSection1">
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'>Bro-Dev Group,</p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'> </p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'>I am doing a little research into using Bro to log and analyze specific Microsoft DCE-RPC interfaces and methods. I notice that the Bro events for ‘dce_rpc_request’ and ‘dce_rpc_response’ provide the length of the RCP data stub (aka ‘stub_len’).
I found reference that these events previously provided a byte string containing the stub data itself, but at some point it was reduced to just the stub_len instead. I have a few questions that I hope you could answer:</p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'> </p>
<ol style="margin-bottom:0; margin-top:0" start="1" type="1">
<li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l0 level1 lfo1'>What was the reason you decided to remove the stub data from the events and pass only the stub length?</li></ol>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0.5in; margin-right:0; margin-top:0; mso-style-priority:34'> </p>
<ol style="margin-bottom:0; margin-top:0" start="2" type="1">
<li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l0 level1 lfo1'>On github, I see a BinPAC file for the RPC ‘At’ service (bro/src/analyzerprotocol/dce-rpc/endpoint-atsvc.pac), but there are no events generated by it. I think this would be very
useful for my project. What is the reason that you have the analyzer, but no events for scriptland?</li></ol>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0.5in; margin-right:0; margin-top:0; mso-style-priority:34'> </p>
<ol style="margin-bottom:0; margin-top:0" start="3" type="1">
<li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l0 level1 lfo1'>I have a use case, for a very few, limited number of RPC interfaces/methods, where I need to receive the stub data in scriptland for logging and analysis. How do you recommend I approach
this scenario? I see a couple options:</li></ol>
<ol style="margin-bottom:0; margin-top:0" start="1" type="a">
<li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0.75in; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l1 level1 lfo2'>I could customize the DCE-RPC analyzer to pass the sub data for *<b>ALL</b>* ‘dce_rpc_request’ and ‘dce_rpc_response’ events; or</li><li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0.75in; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l1 level1 lfo2'>I could customize the DCE-RPC analyzer to create new events specifically for the interfaces/methods (aka UUIDs/OpNums) that I care about.</li><li style='font-family:"Calibri", sans-serif; font-size:11pt; margin-bottom:0.0001pt; margin-left:0.75in; margin-right:0; margin-top:0; mso-style-priority:34; mso-list:l1 level1 lfo2'>Other ideas?</li></ol>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'> </p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'>I think both (a) and (b) will achieve the desired result; but there are trade-offs, pros and cons. I wonder which option would have a more negative impact on Bro performance? I imagine the reason you stopped passing stub data for all events
was due to the performance hit, so I want to approach this in the best way possible. I appreciate your feedback.</p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'> </p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'>Cheers!</p>
<p style='font-family:"Calibri", sans-serif; font-size:11pt; margin:0; margin-bottom:0.0001pt'>Mark</p>
</div>
</div></div></blockquote>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px">
</blockquote><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">_______________________________________________<br>
bro-dev mailing list<br>
bro-dev@bro.org<br>
<a href="http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev" style="color:#777">http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev</a></p>
</blockquote><p dir="auto">--<br>
Seth Hall * Corelight, Inc * www.corelight.com</p>
</div>
</div>
</body>
</html>