Snort mailing list archives
Re: Offer sig for detect Malformed RTF document
From: Tyler Montier <tmontier () sourcefire com>
Date: Thu, 23 Mar 2017 19:01:50 -0400
@rmkml, Thanks for your submission. We will review and test the rule and get back to you when its finished. Sincerely, Tyler Montier Cisco Talos On Thu, Mar 23, 2017 at 4:09 PM, rmkml <rmkml () ligfy org> wrote:
Hello, First, thx @r00tbsd and Talos, Please check sig for detecting Malformed RTF document: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-RTF Malformed RTF with PNG header attempt"; flow:to_client,established; file_data; content:"{|5c|rt"; within:4; distance:0; content:"PNG|0d 0a|"; within:5;distance:1; reference:url,blog.talosintelligence.com/2017/03/ how-malformed-rtf-defeats-security.html; classtype:attempted-user; sid:1; rev:1;) Please send any comments. Best Regards @Rmkml ------------------------------------------------------------ ------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort! Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort! Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Offer sig for detect Malformed RTF document rmkml (Mar 23)
- Re: Offer sig for detect Malformed RTF document Tyler Montier (Mar 23)