From c51ff32adb870dbb5f0ae38ea0595c73c4cd6484 Mon Sep 17 00:00:00 2001 From: Pierre Chifflier Date: Tue, 15 May 2018 16:54:31 +0200 Subject: [PATCH] Document Kerberos 5 parsing events --- doc/userguide/rules/kerberos-keywords.rst | 28 +++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/doc/userguide/rules/kerberos-keywords.rst b/doc/userguide/rules/kerberos-keywords.rst index 91f4f97e38..37339feabf 100644 --- a/doc/userguide/rules/kerberos-keywords.rst +++ b/doc/userguide/rules/kerberos-keywords.rst @@ -83,3 +83,31 @@ Syntax:: Signature example:: alert krb5 any any -> any any (msg:"Kerberos 5 error C_PRINCIPAL_UNKNOWN"; krb5_err_code:6; sid:6; rev:1;) + +krb5.weak_encryption (event) +---------------------------- + +Event raised if the encryption parameters selected by the server are weak or +deprecated. For example, using a key size smaller than 128, or using deprecated +ciphers like DES. + +Syntax:: + + app-layer-event:krb5.weak_encryption + +Signature example:: + + alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 weak encryption parameters"; flow:to_client; app-layer-event:krb5.weak_encryption; classtype:protocol-command-decode; sid:2226001; rev:1;) + +krb5.malformed_data (event) +--------------------------- + +Event raised in case of a protocol decoding error. + +Syntax:: + + app-layer-event:krb5.malformed_data + +Signature example:: + + alert krb5 any any -> any any (msg:"SURICATA Kerberos 5 malformed request data"; flow:to_server; app-layer-event:krb5.malformed_data; classtype:protocol-command-decode; sid:2226000; rev:1;)