How to determine is it SMB - Remote SAM server access , false positive?

Unanswered Question
Sep 12th, 2008

How to determine is it SMB - Remote SAM server access , false positive?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Farrukh Haroon Sat, 09/13/2008 - 00:32

You know it by looking at the source/destination IPs. An IPS is no magic device, its just a 'tool' to enforce your security policy. If those IPs are allowed to access SAM remotely, then its aceeptable (i.e. IPS False Positive), if they are not allowed, its NOT OK (True Positive).



mhellman Tue, 09/16/2008 - 09:11

5583-0 right?

I would say that there are different types of false positives. Do you mean, how do I determine if what what was seen actually represents an attempt to access the SAM database? I would start by looking at MySDN (or whatever Cisco is calling it these days...intellishield?). It's often not very up to date and missing information, but it's an easy thing to check. Here's the link for this sig:

If you look at the benign triggers, you'll see that it suggests that this only matters if the source is external. It's up to you whether to research any further. If you really want to inspect the signature further, you'll have to add one of the "log packets" actions. This will save a network trace when it fires again and then you can open it up in Wireshark, which understands SMB and will probably decode it enough for you to verify whether it actually was an attempt to access the "Remote SAM server".


This Discussion