You will have to change your byte_jump as well, try making it relative to
your MZ match...
Regards,
Will
On 7/13/07, Humes, David G. <David.Humes@jhuapl.edu> wrote:
Removing the depth:2 option seems to have no visible effect. The rule
continues to fire on the examples where it worked previously, and fails
on the same ones where it didn't work before.
> -----Original Message-----
> From: snort-users-bounces@lists.sourceforge.net
> [mailto:snort-users-bounces@lists.sourceforge.net] On Behalf
> Of Matt Jonkman
> Sent: Thursday, July 12, 2007 11:32 PM
> To: Humes, David G.
> Cc: snort-sigs@lists.sourceforge.net;
> snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] [Snort-sigs] Snort rule to detect
> Windows PE Executable Downloads
>
>
>
>
> Humes, David G. wrote:
> > alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"PE Executable
> > Download"; content:"MZ"; depth:2;
> > byte_jump:4,60,little,from_beginning;
> > content:"PE|00 00|"; within:4; flow:established,from_server;
> > sid:8000143; classtype:bad-unknown; rev:1;)
> >
> > It works this executable, http://www.cygwin.com/setup.exe, but not
> > using this,
> http://the.earth.li/~sgtatham/putty/0.60/x86/putty.exe.
> > Why? Could anyone try it on their sensors and let me know if it
> > behaves any differently. Or if anyone has any suggestions
> on how to
> > do this that does not involve matching the "!This program cannot be
> > run in DOS mode." string, that would be appreciated. Sorry Matt, I
> > just don't think you can depend on that string any more.
>
> I think you're right.
>
> The issue with the above is you're assuming the exe is
> starting at the beginning of the packet/stream, which it'll
> not likely be. Drop the depth and try it that way. little
> higher load, but should be more reliable.
>
> If that does the trick then we can put the appropriate
> versions into the bleeding ruleset, and adjust the existing
> to not look for the dos string.
>
> Matt
>
> >
> > I will take a look at the PEHunter plugin that Jamie
> suggests. But, I
> > think the rule, or something very similar, should work in all cases.
> >
> > Thanks.
> >
> > --Dave
> >
> >
> >
> ----------------------------------------------------------------------
> > ---
> > This SF.net email is sponsored by DB2 Express
> > Download DB2 Express C - the FREE version of DB2 express and take
> > control of your XML. No limits. Just data. Click to get it now.
> > http://sourceforge.net/powerbar/db2/
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
> --
> --------------------------------------------
> Matthew Jonkman
> Bleeding Edge Threats
> 765-429-0398
> http://www.bleedingthreats.net
> --------------------------------------------
>
> PGP: http://www.bleedingthreats.com/mattjonkman.asc
>
>
>
> --------------------------------------------------------------
> -----------
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and
> take control of your XML. No limits. Just data. Click to get
> it now. http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
