RE: Assessing Your Malware Exposure with Snort
"Joshua Berry" <[email protected]> Thu, 10 Mar 2005 09:24:20 -0600
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Yes, snort decodes URL's if you have the HTTP inspect preprocessor enabled. In any case, those malware alerts are looking for "Host: <malware_address>", and do not appear to be looking at URL's. Just the Host content in the packet, otherwise they would use the uricontent content checking option. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Keifer, Trey Sent: Wednesday, March 09, 2005 2:51 PM To: Intrusions List (GCIA Practicals) Subject: RE: [Intrusions] Assessing Your Malware Exposure with Snort Does snort automatically decode URL obfuscation? Wouldn't that break your pcre matching if not? --- Trey Keifer, GCIH Security Engineer - Level II Fishnet Security Direct: 816.701.2073 Main: 816.421.6611 Toll Free: 888.732.9406 Fax: 816.474.0394 http://www.fishnetsecurity.com > -----Original Message----- > From: [email protected] [mailto:[email protected]] > Sent: Tuesday, February 15, 2005 10:39 AM > To: [email protected] > Subject: [Intrusions] Assessing Your Malware Exposure with Snort > > I have written a few thousand Snort rules that are intended > to detect successful HTTP communication with hosts known to > be evil. They look for domain names in the Host string so > they are not subject to evasion by changing IP addresses. > > If you would like to give them a try you can grab them from > http://www.kgb.to/malware.html . _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions