The issue is that, if you're going to use content clauses in a rule, at
least one of them must be a regular content (i.e. content you're
searching for, a la 'content:"Foo";'). The rule would function properly
(albeit slowly) if you removed all of the content clauses, or if it were
written as:
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE
Malware Gator Agent Traffic"; flow:to_server,established;
content:"User-Agent|3A|"; nocase; content:!"Akregator"; nocase;
distance:0; pcre:"/^User-Agent\x3A[^\n]+Gator/smi"; classtype:
policy-violation; sid: 2000026; rev:12;)
which would a) fix potential parser issues with colons inside of a
content or a PCRE (using "\:" does not escape the colon on some versions
of Snort), and b) allow you to find packets which contained
"User-Agent", where that string was not followed by "Akregator", which I
believe is roughly the intent of the original rule.
HTH,
Alex Kirk
Research Analyst
Sourcefire, Inc.
Received this error after a cold start:
Apr 11 07:23:26 smtp snort[89121]: SNORT DETECTION ENGINE: Pure Not Rule
'BLEEDING-EDGE Malware Gator Agent Traffic' not added to detection
engine. These rules are not supported at this time.
Rule is this, in bleeding-malware.rules
(Gator isn't malware anymore because Microsoft bought Clarion, right? ;-)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
"BLEEDING-EDGE Malware Gator Agent Traffic"; flow:
to_server,established; flowbits:isset,http.UserAgent;
content:!"User-Agent\: Akregator"; pcre:"/User-Agent\:[^\n]+Gator/i";
classtype: policy-violation; sid: 2000026; rev:11;)
(the theory behind the [^\n] is that malware could move the gator tag
behind an extra space or two.. however, if they waned to hide it, they
could just change name)
Why is this a pure 'not' rule? does the NOT detector consider pcre as
valid?
is the flowbits:isset.http.UserAgent just adding complexity to this?
could this be solved with: (didn't error this time)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:
"BLEEDING-EDGE Malware Gator Agent Traffic"; flow:
to_server,established; content:"User-Agent\:"; nocase;
content:!"User-Agent\: Akregator"; pcre:"/User-Agent\:[^\n]+Gator/i";
classtype: policy-violation; sid: 2000026; rev:12;)
snort version 2.4.4:
snort -V
,,_ -*> Snort! <*-
o" )~ Version 2.4.4 (Build 28) FreeBSD
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/team.html
(C) Copyright 1998-2005 Sourcefire Inc., et al.
Freebsd 4.11, normlish set of rules, snort command line:
ps -wwp89121
PID TT STAT TIME COMMAND
89121 ?? Ss 0:01.25 /usr/local/bin/snort -doDI -m 022 -k none -c
/etc/snort/snort_lan.conf -i em1 -l /var/log/snort_lan -F
/etc/snort/snort_lan.bpf
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
