Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | [Snort-users] modifying priority on certain rules |
|---|---|
| Date: | Tue, 21 Feb 2006 15:50:29 -0500 |
I am running snort v2.3.3. I would like to change the priority of a few
certain rules (without affecting the default classification.config
priority). I thought I could achieve this by copying the rule from its
rule file into local.rules. In local.rules, I added the priority
classification. Here's an example:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|";
depth:1; content:"|FF|SMBu"; within:5; distance:3;
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R";
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|";
distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2; sid:2466; rev:7;)
The problem is that this rule doesn't trigger. If I modify the rule to
not include the sid and rev, it will trigger:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|";
depth:1; content:"|FF|SMBu"; within:5; distance:3;
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R";
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|";
distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2;)
However, I would like to keep the sid information. Is that possible? Or
is there a better way to achieve this?
Thanks,
Christina
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | [Fwd: RE: [Snort-users] Changing default syslog Facility:Priority for all alerts], Mark Tunnell |
|---|---|
| Next by Date: | Re: [Snort-users] modifying priority on certain rules, sekure |
| Previous by Thread: | [Fwd: RE: [Snort-users] Changing default syslog Facility:Priority for all alerts], Mark Tunnell |
| Next by Thread: | Re: [Snort-users] modifying priority on certain rules, sekure |
| Indexes: | [Date] [Thread] [Top] [All Lists] |