[Bro-Dev] [JIRA] (BIT-1286) Add policy script for Windows version detection via CryptoAPI HTTP Traffic
jira at bro-tracker.atlassian.net
Mon Nov 3 10:56:07 PST 2014
grigorescu created BIT-1286:
Summary: Add policy script for Windows version detection via CryptoAPI HTTP Traffic
Project: Bro Issue Tracker
Issue Type: New Feature
Affects Versions: git/master
Windows systems access a Microsoft Certificate Revocation List (CRL) periodically. The user agent for these requests reveals which version of Crypt32.dll installed on the system, which can uniquely identify the version of Windows that's running.
This branch adds a Software framework policy script will log the version of Windows that was identified.
This message was sent by Atlassian JIRA
More information about the bro-dev