Alerts for OOXML and MOX

[Will via Snort-sigs <snort-sigs () lists snort org>]

Hello,
    I am pretty new to the Snort world.  I am wondering if it is possible to create an alert that can look inside OOXML 
or MOX type formats to find clear text content.  The thing about these file types are they are compressed files with 
it's own  file structure within the file.  What I am aiming at doing is to have an snort alert look for people trying 
to off load (Copy) lots of sensitive data (Like Social Security Numbers) from these type files.  One alert I created 
looks like this.
alert tcp any any -> any any (msg:"Sensitive Info being Accessed"; pcre:"/\d{3}\-\d{2}\-\d{4}/"; sid: 100001)
But this alert only works for things like text files.
I am thinking there might have to be a preprocessing for this to work?  Is there something like this out there?

- Will

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

http://www.snort.org

Please visit http://blog.snort.org for the latest news about Snort!

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!