Snort mailing list archives
Re: Snort rule for a pattern match?
From: "Shields, Joseph (NIH/NIEHS) [C]" <joseph.shields () nih gov>
Date: Wed, 27 Mar 2013 14:47:19 +0000
Joel Esler advised this yesterday. I haven't had a chance yet to research. I plan to today after I get some weekly reports out. "Take a look at the Snort ruleset from www.snort.org/snort-rules and look for rules with byte_extract in them." -----Original Message----- From: lists () packetmail net [mailto:lists () packetmail net] Sent: Wednesday, March 27, 2013 10:40 AM To: Lay, James; Shields, Joseph (NIH/NIEHS) [C] Cc: snort-sigs () lists sourceforge net Subject: Re: [Snort-sigs] Snort rule for a pattern match? On 03/27/2013 09:29 AM, Lay, James wrote:
James, The traffic could be on most any port, though it likely will be web. I think PCRE would be possible if the PERL look ahead with calc capability is supported. I’ve not seen anything showing this implementation. Namely, (?{ code }).
Look-aheads work, check out SID 2016551 in the ET ruleset. Check the PCRE with the negated look ahead. alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Neutrino EK Downloading Jar"; flow:established,to_server; content:"?h"; http_uri; content:" Java/1."; http_header; fast_pattern; pcre:"/\/[a-z]+\?h(?!ash)[a-z]{5,}=[a-f0-9]{24}$/U"; classtype:trojan-activity; sid:2016551; rev:3;) Cheers, Nathan ------------------------------------------------------------------------------ Own the Future-Intel® Level Up Game Demo Contest 2013 Rise to greatness in Intel's independent game demo contest. Compete for recognition, cash, and the chance to get your game on Steam. $5K grand prize plus 10 genre and skill prizes. Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 07)
- <Possible follow-ups>
- FW: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 07)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 26)
- Re: Snort rule for a pattern match? Joel Esler (Mar 26)
- Re: Snort rule for a pattern match? Jamie Riden (Mar 26)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 26)
- Re: Snort rule for a pattern match? Lay, James (Mar 26)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 26)
- Re: Snort rule for a pattern match? Lay, James (Mar 27)
- Re: Snort rule for a pattern match? lists () packetmail net (Mar 27)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 27)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 27)
- Re: Snort rule for a pattern match? lists () packetmail net (Mar 27)
- Re: Snort rule for a pattern match? Joel Esler (Mar 27)
- Re: Snort rule for a pattern match? Shields, Joseph (NIH/NIEHS) [C] (Mar 26)