Negate Content - Snort Rules
João Pedro Lola via Snort-sigs <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <AM6PR10MB2742201F085843EA8596A4408C349@AM6PR10MB2742.EURPRD10.PROD.OUTLOOK.COM> |
Hello All, In a snort rule, why can´t i have two negate contents and third not negate content? If i can, how do I write it to work? Example: alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNA_NET $HTTP_PORTS ( msg:"a message..."; flow:stateless; content:!"|76 69 64 65 6f 2f 6d 70 65 67|"; offset:13; depth:10; content:!"|61 75 64 69 6f 2f 6d 70 65 67|"; distance:1; within:10; content:"|61 75 64 69 6f 2f 6d 70 65 67|"; distance:1; within:10; classtype:tcp-connection; sid:3024678; rev:1;) Best Regards, João Lola _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!