Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]

[Snort-users] modifying priority on certain rules

Subject: [Snort-users] modifying priority on certain rules
Date: Tue, 21 Feb 2006 15:50:29 -0500
I am running snort v2.3.3.  I would like to change the priority of a few 
certain rules (without affecting the default classification.config 
priority).  I thought I could achieve this by copying the rule from its 
rule file into local.rules.  In local.rules, I added the priority 
classification.  Here's an example:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ 
unicode share access"; flow:established,to_server; content:"|00|"; 
depth:1; content:"|FF|SMBu"; within:5; distance:3; 
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; 
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; 
distance:2; nocase; flowbits:set,smb.tree.connect.ipc; 
classtype:protocol-command-decode; priority:2; sid:2466; rev:7;)

The problem is that this rule doesn't trigger.  If I modify the rule to 
not include the sid and rev, it will trigger:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ 
unicode share access"; flow:established,to_server; content:"|00|"; 
depth:1; content:"|FF|SMBu"; within:5; distance:3; 
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; 
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; 
distance:2; nocase; flowbits:set,smb.tree.connect.ipc; 
classtype:protocol-command-decode; priority:2;)

However, I would like to keep the sid information.  Is that possible?  Or 
is there a better way to achieve this?

Thanks,
Christina
<Prev in Thread] Current Thread [Next in Thread>