Snort mailing list archives

Dectecting Social Security Numbers?


From: "Lyons, Jon" <Jon_Lyons () enh org>
Date: Fri, 10 Sep 2004 13:01:44 -0500

 
I'm trying to get snort to generate an alert for SS#'s, I've tried the
rule below but no alerts are generated. I tested this with pcretest and
it works...am I missing something?
alert tcp any any -> any any (msg:"Socail Security Number Clear Text";
pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)

Current thread: