Quick Question: base64 snort options

[Kevin Ross <kevross33 () googlemail com>]

hey. I am wondering if I understand this right as I think this could be
useful for these 2.9 snort options. If you specifcy a HTTP post and then
base64 data followed by windows or service pack or some other phrase will
snort then check the decoded base64 string whereever it may be for that
string within the depth you specify such as:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CNC Possible
Base64 XP SP Operating System Type Post"; flow:established,to_server;
content:"POST"; http_method; base64_decode; base64_data; content:"XP SP";
nocase; within:100; classtype:trojan-activity; sid:156006; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CNC Possible
Base64 OS Windows Post"; flow:established,to_server; content:"POST";
http_method; base64_decode; base64_data; content:"windows"; nocase;
within:100; classtype:trojan-activity; sid:156008; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CNC Possible
Base64 Windows Service Pack Post"; flow:established,to_server;
content:"POST"; http_method; base64_decode; base64_data; content:"service
pack"; nocase; within:100; classtype:trojan-activity; sid:156009; rev:1;)

Just I was thinking if this was the case and with a little work they could
be a generic detection for some malware CNC communication. i.e this sort of
thing https://www.honeynet.org/node/539

Am I on the right track or have I misunderstood how these rule options work?
Thanks, Kev

------------------------------------------------------------------------------
Free Software Download: Index, Search & Analyze Logs and other IT data in 
Real-Time with Splunk. Collect, index and harness all the fast moving IT data 
generated by your applications, servers and devices whether physical, virtual
or in the cloud. Deliver compliance at lower cost and gain new business 
insights. http://p.sf.net/sfu/splunk-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users