Re: Couple sigs

[James Lay <jlay () slave-tothe-box net>]

On 2012-09-10 07:52, Alex Kirk wrote:
> With, that is, some tweaks to be slightly less specific. If you can 
> be
> evaded by simply switching the order of the width and height on the
> first one, for example, well, youre probably less than useful.

Thanks Alex.  For the hidden iframe, I'm thinking maybe something like 
the below:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any 
(msg:"INDICATOR-COMPROMISE Hidden iframe"; flow:to_client, established; 
file_data; content:"<iframe"; content:"width="; content:"height="; 
pcre:"/=[0-1]/ms"; content:"style=visibility|3a|hidden"; 
classtype:bad-unknown; sid:10000023; rev:2;)

I was thinking a byte_test that will test to see if width= or height= 
are less than say 2, but I haven't yet figured out how to get that to 
fly, so I guess the pcre will suffice for now.  This alerts on my packet 
cap, and so far no FP's running live.  You think some within statements 
might help?  Thanks Alex.

James

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!