If you have DCE/RPC Preprocessor enabled, then you have seen lot of alerts in FMC against these signatures
|
Traffic |
Preprocessor Rule GID:SID |
|
SMB |
133:2 through 133:26, and 133:48 through 133:57 |
|
Connection-Oriented DCE/RPC (TCP 135) |
133:27 through 133:39 |
|
Detect Connectionless DCE/RPC (UDP 135) |
133:40 through 133:43 |
But what is SMB DIALECT?
It is used to negotiate the SMB version to be used in communication between two systems. The version of SMB used between two computers will be the highest dialect supported by both. This means if a Windows 8 machine is talking to a Windows 8 or Windows Server 2012 machine, it will use SMB 3.0. If a Windows 10 machine is talking to Windows Server 2008 R2, then the highest common level is SMB 2.1.
**** SMB 2.????
