SMB: DCERPC Unexpected Response

This anomaly triggers when it detects packets containing known evasion techniques that affect the SMB, DCE, RPC, and MS RPC protocols. These packets are normally not seen in traffic and indicate attempts to evade network defense systems by sending invalid, out of order, or heavily fragmented communications. Use this signature only at WAN borders to reduce false positive possibilities.

Short Name

SMB:AUDIT:DCERPC-UNEXPECTED-RSP