Re: Assessing Your Malware Exposure with Snort

Brian <[email protected]> writes:

> On Thu, Mar 10, 2005 at 03:39:10PM -0600, [email protected] wrote:
>> <snip>
>> My tweaked "for speed" meat of the rule version is:
>> 
>>     flow:established,to_server; content:"whenyousearch.com"; nocase;
>>     pcre:"/^Host\x3a\s*[a-z0-0\.-]+\.whenyousearch.com/smi";
>> </snip>
>
> note, I see one error in my ways...
>
>      flow:established,to_server; content:"whenyousearch.com"; nocase;
>      pcre:"/^Host\x3a\s*[a-z\d\.-]+\.whenyousearch.com$/smi";
>
> \w+ would be be faster, but _ isn't valid in hostnames IIRC.

It's not valid per the RFC, but I have seen it used now and then.

-- 
James Riden / [email protected] / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions