Received this error after a cold start:
Apr 11 07:23:26 smtp snort[89121]: SNORT DETECTION ENGINE: Pure Not Rule
'BLEEDING-EDGE Malware Gator Agent Traffic' not added to detection
engine. These rules are not supported at this time.
Rule is this, in bleeding-malware.rules
(Gator isn't malware anymore because Microsoft bought Clarion, right? ;-)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
"BLEEDING-EDGE Malware Gator Agent Traffic"; flow:
to_server,established; flowbits:isset,http.UserAgent;
content:!"User-Agent\: Akregator"; pcre:"/User-Agent\:[^\n]+Gator/i";
classtype: policy-violation; sid: 2000026; rev:11;)
(the theory behind the [^\n] is that malware could move the gator tag
behind an extra space or two.. however, if they waned to hide it, they
could just change name)
Why is this a pure 'not' rule? does the NOT detector consider pcre as valid?
is the flowbits:isset.http.UserAgent just adding complexity to this?
could this be solved with: (didn't error this time)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
"BLEEDING-EDGE Malware Gator Agent Traffic"; flow:
to_server,established; content:"User-Agent\:"; nocase;
content:!"User-Agent\: Akregator"; pcre:"/User-Agent\:[^\n]+Gator/i";
classtype: policy-violation; sid: 2000026; rev:12;)
snort version 2.4.4:
snort -V
,,_ -*> Snort! <*-
o" )~ Version 2.4.4 (Build 28) FreeBSD
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2005 Sourcefire Inc., et al.
Freebsd 4.11, normlish set of rules, snort command line:
ps -wwp89121
PID TT STAT TIME COMMAND
89121 ?? Ss 0:01.25 /usr/local/bin/snort -doDI -m 022 -k none -c
/etc/snort/snort_lan.conf -i em1 -l /var/log/snort_lan -F
/etc/snort/snort_lan.bpf
--
Michael Scheidell, CTO
SECNAP Network Security
561-999-5000, x 1131
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
