Snort mailing list archives
Re: Excessive alerts on SID 17407 -- Windows help file download
From: Joel Esler <jesler () sourcefire com>
Date: Sun, 29 Jan 2012 10:39:05 -0500
The current rev of that rule is the following: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows help file download request"; flow:to_server,established; content:".hlp"; fast_pattern; nocase; http_uri; pcre:"/\x2ehlp([\?\x5c\x2f]|$)/smiU"; flowbits:set,file.hlp; reference:cve,2006-3357; reference:cve,2006-4138; classtype:misc-activity; sid:17407; rev:10;) The most recent change of which was on 2011-12-01. I suggest using pulledpork for your Rule updates: http://blog.snort.org/2012/01/importance-of-pulledpork.html -- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire On Jan 27, 2012, at 1:58 PM, Bachelor, Stephen A CTR USSOCOM HQ wrote:
This often triggers on content which is not a help file, such as "GET /iu/api/res/1.2/Ip7475OzCLIWah.hLpjbYw--/YXBwaWQ9eXZpZ" Is there any reason I shouldn't add, after the content rule, pcre:"/\.hlp[^a-zA-Z0-9]/smi"; Original rule text below: Rule alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"WEB-CLIENT Windows help file download request"; flow:to_server,established; content:".hlp"; nocase; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2006-3357; reference:cve,2006-4138; classtype:attempted-user; sid:17407; rev:4; ) ------------------------------------------------------------------------------ Try before you buy = See our experts in action! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-dev2 _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ Try before you buy = See our experts in action! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-dev2
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Excessive alerts on SID 17407 -- Windows help file download Bachelor, Stephen A CTR USSOCOM HQ (Jan 27)
- Re: Excessive alerts on SID 17407 -- Windows help file download rmkml (Jan 27)
- Re: Excessive alerts on SID 17407 -- Windows help file download Joel Esler (Jan 29)