Re: Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt]

That would grab all traffic from the host. You should be able to filter it down to only the traffic that is triggering the event. Then use that to replay back into snort and check your rules/configuration. The ports listed below aren't the defaults for MSSQL.



Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: John <[email protected]>
Sent: Tuesday, December 19, 2023 1:07 PM
To: Al Lewis (allewi) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-sigs] Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt]

I did not create a capture.  It has been a long time since I used tcpdump.  Is this the correct way to grab some traffic?

Assuming the target IP is 10.9.5.106:

tcpdump -i eth0 host 10.9.5.106 -w /tmp/capture

On Tuesday, December 19th, 2023 at 12:23 PM, Al Lewis (allewi) <[email protected]> wrote:


> Do you have a pcap of the traffic that you can share?
>
>
> Albert Lewis
>
> Email: [email protected]
>
> From: Snort-sigs <[email protected]> on behalf of John via Snort-sigs <[email protected]>
> Sent: Tuesday, December 19, 2023 7:57 AM
> To: [email protected] <[email protected]>
> Subject: [Snort-sigs] Zoom meeting causes many [SERVER-MSSQL probe response overflow attempt]
>
> When in a zoom meeting, snort is dropping hundreds of thousands packets which are getting flagged as:
>
> "SERVER-MSSQL probe response overflow attempt" [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {UDP} 206.247.41.152:8801 -> 10.1.2.202:60966
>
> Is this a false positive?
> _______________________________________________
> Snort-sigs mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!

_______________________________________________
Snort-sigs mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!