MS-RPC: Evasion Technique (4a)

This anomaly triggers when it detects packets containing known evasion techniques that affect the SMB, DCE RPC, and MS RPC protocols. These packets should not be seen in normal traffic and indicate attempts to evade network defense systems by sending invalid, out of order, or heavily fragmented communication. Due to potential false-positives in some older MS-RPC services, this anomaly should only be used to inspect traffic going to and from the Internet on WAN links. This anomaly should NOT be used to monitor traffic between internal servers/clients on a LAN or inter-office WAN.

Short Name

MS-RPC:EVASION:DCE-LARGE-FRAG-2

Severity

Minor

Recommended

True

Recommended Action

None

MS-RPC: Evasion Technique (4a)

Found a potential security threat?