Re: SMTP traffic

Hi ,

 Signature will have to be dependent upon some flag. When the value of flag is 
set then only the signature will get activated. 

The value of flag will have to be set by some decoding signature. Decoding 
signature will parse the SMTP traffic and set the value of flag. It will be at 
high priority as compared to the  other signatures. I have written the psuedo 
code of decoding algo which sets the value of flag a.

 So to the FP free signature for Mail From command to prevent FP,will check the 
value of flag. If value of flag a = 1, then only signature should get 
activated..





If (pattern="HELO" or ?EHLO? or ?LHLO?)
  
  STEP 1 {
Varible a = 1;   # HELO, EHLO LHLO are the first commands in SMTP  # Connection
         }

    If (pattern="DATA\r\n" or pattern=?DATA\n? GOTO STEP 2 else STEP 1)
 
  STEP 2 {
             
              Variable a = 2; 
         }

    If (pattern="\n\r\n" or pattern=?\n\n? GOTO STEP 3 or STEP 2)
  
  STEP 3{
          Variable a = 3;
        }
 If (pattern="\n\x2E\n" or pattern =?\n\x2E\r\n? GOTO STEP 4 else STEP 3)
STEP 4 {
          Variable a = 1; 
         }

 If (pattern="RSET")
   STEP 1 {
          Variable a = 1; # This operation will clear the variable. 
      }




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to 
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
 
to learn more.
------------------------------------------------------------------------