Re: Excessive alerts on SID 17407 -- Windows help file download

[rmkml <rmkml () yahoo fr>]

Hi Stephen,
Maybe try SF SEU update?
because this sid are on rev 10 around 7 dec 2011...
contains pcre for restrict FP.
Regards
Rmkml


On Fri, 27 Jan 2012, Bachelor, Stephen A CTR USSOCOM HQ wrote:

> This often triggers on content which is not a help file, such as "GET
> /iu/api/res/1.2/Ip7475OzCLIWah.hLpjbYw--/YXBwaWQ9eXZpZ"
>
> Is there any reason I shouldn't add, after the content rule,
> pcre:"/\.hlp[^a-zA-Z0-9]/smi";
>
>
> Original rule text below:
>
>       Rule    alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> (msg:"WEB-CLIENT Windows help file download request";
> flow:to_server,established; content:".hlp"; nocase; http_uri;
> metadata:policy balanced-ips drop, policy security-ips drop, service
> http; reference:cve,2006-3357; reference:cve,2006-4138;
> classtype:attempted-user; sid:17407; rev:4; )

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!