topic Re: Custom Signature Help in Custom Signatures

Custom Signature Help

phi1771 — Thu, 13 Jul 2017 19:40:31 GMT

Hi,

I'm attempting to create an application signature to detect Amazon AWS backups. I captured SSL client hello packets to get the the below hex for the pattern match, but signature is not fireing.

Packet,

Hex value,

/x 3531333438623763302d646432372d313164662d393337622d3038303032303063396136362e73332e616d617a6f6e6177732e636f6d /x

Signature condition match,

Re: Custom Signature Help

Lucky — Fri, 14 Jul 2017 08:16:13 GMT

Hello,

does it work when you chop it up in smaller pieces?

Best regards,
Luciano

Re: Custom Signature Help

phi1771 — Fri, 14 Jul 2017 18:44:20 GMT

Looks like my issue was due to spaces on the hex indicators and I was using /x instead of \x. It worked after modifying the pattern match to the below,

\x3531333438623763302d646432372d313164662d393337622d3038303032303063396136362e73332e616d617a6f6e6177732e636f6d\x