Re: Snort rule to detect Windows PE Executable Downloads

["Humes, David G." <David.Humes () jhuapl edu>]

I realize my question was a bit long winded.  Let's try something
simpler.

I think this rule should be highly effective in detecting the download
of a Windows PE executable file.

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"PE Executable
Download"; content:"MZ"; depth:2; byte_jump:4,60,little,from_beginning;
content:"PE|00 00|"; within:4; flow:established,from_server;
sid:8000143; classtype:bad-unknown; rev:1;)

It works this executable, http://www.cygwin.com/setup.exe, but not using
this,  http://the.earth.li/~sgtatham/putty/0.60/x86/putty.exe.  Why?
Could anyone try it on their sensors and let me know if it behaves any
differently.  Or if anyone has any suggestions on how to do this that
does not involve matching the "!This program cannot be run in DOS mode."
string, that would be appreciated.  Sorry Matt, I just don't think you
can depend on that string any more.  

I will take a look at the PEHunter plugin that Jamie suggests.  But, I
think the rule, or something very similar, should work in all cases.

Thanks.

--Dave


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users