Snort mailing list archives
Re: Excluding a domain in snort rule
From: "Joel Esler (jesler)" <jesler () cisco com>
Date: Tue, 6 Jun 2017 19:58:33 +0000
I would suggest disabling that rule all together. That pattern hasn’t been used in years. -- Joel Esler | Talos: Manager | jesler () cisco com<mailto:jesler () cisco com> On Jun 6, 2017, at 3:47 PM, John G <drterdnugget () gmail com<mailto:drterdnugget () gmail com>> wrote: I have this alert that is triggering on a legitimate site. EXPLOIT-KIT Angler exploit kit news uri structure (1:38439:2) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Angler exploit kit news uri structure"; flow:to_server,established; content:"/news/"; fast_pattern; http_uri; content:"/"; within:5; distance:1; http_uri; content:"/"; within:5; distance:1; http_uri; content:"/"; within:5; distance:1; http_uri; pcre:"/^\/news\/([0-9]+\/){3}[0-9]{5,10}(\.html)?$/U"; metadata:impact_flag red, policy max-detect-ips drop, service http; classtype:trojan-activity; sid:38439; rev:2; ) It is triggering because of this site: http://www<http://www/>[.]wenxuecity[.]com/news/2017/06/06/6293116.html How could we go about whitelisting that by editing the Snort rule? Thanks, John ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org<http://Slashdot.org>! http://sdm.link/slashdot_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net<mailto:Snort-sigs () lists sourceforge net> https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort! Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort! Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
Current thread:
- Excluding a domain in snort rule John G (Jun 06)
- Re: Excluding a domain in snort rule Joel Esler (jesler) (Jun 06)
- Re: Excluding a domain in snort rule lists (Jun 06)