Negate Content - Snort Rules

João Pedro Lola via Snort-sigs <[email protected]>
Newsgroups gmane.comp.security.ids.snort.sigs
Message-ID <AM6PR10MB2742201F085843EA8596A4408C349@AM6PR10MB2742.EURPRD10.PROD.OUTLOOK.COM>
Hello All,

In a snort rule, why can´t i have two negate contents and third not negate content? If i can, how do I write it to work?

Example:

alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNA_NET $HTTP_PORTS (
msg:"a message...";
 flow:stateless;
content:!"|76 69 64 65 6f 2f 6d 70 65 67|"; offset:13; depth:10;
content:!"|61 75 64 69 6f 2f 6d 70 65 67|"; distance:1; within:10;
content:"|61 75 64 69 6f 2f 6d 70 65 67|"; distance:1; within:10;
classtype:tcp-connection; sid:3024678; rev:1;)

Best Regards,
João Lola

_______________________________________________
Snort-sigs mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.