Snort mailing list archives
RE: Dectecting Social Security Numbers?
From: "Harper, Patrick" <patrick.harper () phns com>
Date: Fri, 10 Sep 2004 15:24:06 -0500
It will catch some cookies too, but works pretty good over all. I am not the best at rule writing :) There is a way to make it only trigger if there is a blank space in front and back but I have not had the time to look it up. If anyone know how to do this off the top of there head let me know. Although this is really a snort-sigs question. (I hope there is a penalty drink in that for me seeing as it is Friday. I guess I could answer my own post and reply in HTML and that would start the evening off right :) ) -----Original Message----- From: Lyons, Jon [mailto:Jon_Lyons () enh org] Sent: Friday, September 10, 2004 3:15 PM To: Harper, Patrick; snort-users () lists sourceforge net Subject: RE: [Snort-users] Dectecting Social Security Numbers? Thanks, I've tried multiple rules, but this one works the best... Thanks! -----Original Message----- From: Harper, Patrick [mailto:patrick.harper () phns com] Sent: Friday, September 10, 2004 3:10 PM To: Lyons, Jon; snort-users () lists sourceforge net Subject: RE: [Snort-users] Dectecting Social Security Numbers? I use: alert ip $HOME_NET any -> $EXTERNAL_NET any (pcre:"/[1-9]{3,3}[-][1-9]{2,2}[-][1-9]{4,4}/"; msg:"SSN# in clear text"; classtype:policy-violation; sid:2000370; rev:2;) Works for me -----Original Message----- From: Lyons, Jon [mailto:Jon_Lyons () enh org] Sent: Friday, September 10, 2004 1:02 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Dectecting Social Security Numbers? I'm trying to get snort to generate an alert for SS#'s, I've tried the rule below but no alerts are generated. I tested this with pcretest and it works...am I missing something? alert tcp any any -> any any (msg:"Socail Security Number Clear Text"; pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";) Disclaimer: This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. Disclaimer: This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Dectecting Social Security Numbers? Lyons, Jon (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Re: Stealth network card sekure (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- <Possible follow-ups>
- Re: Dectecting Social Security Numbers? Dan Fiorito (Sep 10)
- RE: Dectecting Social Security Numbers? Harper, Patrick (Sep 10)
- Message not available
- RE: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Brian (Sep 10)