Re: Rule Making Question

Every keyword in a Snort rule has to be true for the rule to fire.  If a
single content, pcre, byte_test, etc. doesn't evaluate to TRUE then the
whole rule doesn't match the packet.  No, you can't change that behavior.

Alex Tatistcheff
[email protected]

Amazon Author Page <https://www.amazon.com/author/alext>


On Tue, Oct 12, 2021 at 8:55 AM EGD via Snort-sigs <
[email protected]> wrote:

> I am new to rule writing and wanted to know when using multiple "content"
> tags and "pcre" tags if they are conditional. In other words, do they
> trigger if all of them get found true or if at least one does.
>
> i.e. content: "username"; content: "| 4c 55 6d|"; pcre "^[wW]hat[
> .-]?[eE]ver$"
>
> would the rule trigger is only one of the above examples is true or if all
> - bonus question, could I make it conditional within the rule?
>
>
> Sent with ProtonMail <https://protonmail.com/> Secure Email.
>
> _______________________________________________
> Snort-sigs mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure
> to stay up to date to catch the most <a href="
> https://snort.org/downloads/#rule-downloads">emerging threats</a>!
>

_______________________________________________
Snort-sigs mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!