Summary

The Deep Security Agent in Deep Security or Cloud One - Endpoint & Workload Security uses the network DPI engine for the Intrusion Prevention Module. The network DPI engine currently does not support the SMB3 encrypted protocol. If the customer needs to apply any of the following policies listed below, they need to switch the protocol version of the CIFS or Samba server to SMB2 or below.

Here is the list of IPS rules: 

• 1007064 - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
• 1007065 - Executable File Uploaded On Network Share
• 1007114 - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
• 1007134 - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
• 1008179 - Restrict File Extensions For Rename Activity Over Network Share
• 1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)