How to flag DRSUAPI_REPLICA_ADD signature ?

edit

Thanks but it just allow to filter the "DRSUAPI-REPLICA-ADD" in wireshark. The purpose is to extract a generic hexadecimal signature to be able to use it with an IPS custom rule.

As I can see, we can identify it with the "Opnum :5" value in the DCE/RPC request. I'm trying to identify a unique generic signature to detect a DCE/RPC request with this specific Opnum value. https://ibb.co/inHYCJ

Any ideas ?

Have you looked at the highlighted binary data?

Yes I did. But I can only get the DRSUAPI-REPLICA-ADD with encrypted stub data. The problem is if I change datas within my DC Shadow attack, the encrypted stub data change so it's a new signature and it's not detected by the IDS. That's why I'm trying to find a generic signature just to identify the "DRSUAPI-REPLICA-ADD" into a packet.

Do you know how wireshark is able to detect that the protocol used is DRSUAPI ?

Do you know how wireshark is able to detect that the protocol used is DRSUAPI ?

Without a proper capture file I'm sure I won't.

Here is an archive with 2 different packet capture file. https://nofile.io/f/1P4DNYj2qOS/captu...

If you take the first capture and filter on dcerpc.cn_ctx_id == 0, you'll see in packet 428 a Context being created, with ID 0, which is mapped to DRSUAPI. So when the DCERPC packet in packet 449 comes by it's in that protocol. The Opnum 5 is then DRSUAPI_REPLICA_ADD.

At least that is how I read it, a DCERPC protocol specialist may point out other relevant details. In short, there seems to be a context created, something that may not be possible in your setup.

Thanks I'll try to explore this way to see if I'm able to follow the TCP stream from the creation of the context to the DRSUAPI_REPLICA_ADD request and then block it.

By the way, do you know how could I identify DCE/RPC protocol in a TCP packet ?

Well, the DCERPC dissector uses a function called is_dcerpc(), which:

1. Checks that there are enough bytes in the stream to contain the common header (whatever that may be)
2. Checks that the first byte indicates 5 (major version)
3. Checks that the second byte indicates 0 or 1 (minor version)
4. Checks that the third byte being less that the RTS pdu type

Thanks I'm going to try to detect DCE/RPC by identifying those values