Re: File.swf.cff has 2 sections for flowbits?

[wkitty42 () windstream net]

On 06/13/2018 09:29 PM, Gerry Carpinetti via Snort-users wrote:
> I have noticed some have flowbits in 2 different sections of a single line of 
> code for example:
> Flowbits:isset, file.swf; and again flowbits:set, file.swf.cff which is the 
> Warning is set but not ever checked.


look at that very closely... it is checking if the file.swf flowbit is set... if 
it is and the rest of the rule matches, then the file.swf.cff flowbit is also 
set... now you have two flowbits set... the first indicates there is a swf file 
and the second indicates the swf file is utilizing the "CFF Feature count"...


> So how are you going to handle one of these that has flowbits mentioned twice in 
> a single line and some have matching SID’s. So the question is which one are you 
> suppose to modify when a line has 2 sections for flowbits???


you don't modify any of them! you find at least one rule that has 
"isset,file.swf.cff" and enable it by removing the "#" from the beginning of its 
line...

in the rules sets that i have, that means enabling 25681 and/or 25683...


--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette