Snort mailing list archives
Re: Dectecting Social Security Numbers?
From: Matt Kettler <mkettler () evi-inc com>
Date: Fri, 10 Sep 2004 15:48:31 -0400
At 02:01 PM 9/10/2004, Lyons, Jon wrote:
Im trying to get snort to generate an alert for SS#s, Ive tried the rule below but no alerts are generated. I tested this with pcretest and it works am I missing something? alert tcp any any -> any any (msg:"Socail Security Number Clear Text"; pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)
I can't possibly imagine why that rule works with pcretest, but if you say so... It's clearly not any valid regex syntax that I've ever seen before, and it looks nothing like the regex syntax of any of the default rules in the snort ruleset.
What's the m! out front supposed to be doing, and why isn't that PCRE properly bounded with /'es? (all regexes should be bounded with a / at the start and a / at the end, with modifiers following the trailing /)
try something more like this to start with, then add PCRE syntax as needed: pcre:"/\d\d\d[-/]\d\d[-/]\d\d\d\d\b/"Note: I substituted \b for your \Z. I don't think EOL is really a good termination condition to use when doing general text string searches.. what if it's in record-per-line format where the name comes after the SSN?
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Dectecting Social Security Numbers? Lyons, Jon (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Re: Stealth network card sekure (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- <Possible follow-ups>
- Re: Dectecting Social Security Numbers? Dan Fiorito (Sep 10)
- RE: Dectecting Social Security Numbers? Harper, Patrick (Sep 10)
- Message not available
- RE: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Brian (Sep 10)