topic Re: Creating custom signatures in Automation/API Discussions

Creating custom signatures

mmarceli — Wed, 12 Nov 2014 21:23:16 GMT

Is there a way to create a signature to block or alert as referenced by this website...

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27208

The sample url comes from the link below

http://l.facebook.com/l/8AQEvKJix/christmasoffers.org/babykit.html

If this signature is already in the latest updates, please let us know.

Re: Creating custom signatures

lewis — Thu, 13 Nov 2014 16:08:02 GMT

You could create a custom vulnerability signature, in this case for http://l.facebook.com/l/8AQEvKJix/christmasoffers.org/babykit.html you could accomplish it by creating a http-req-uri-path signature with christmasoffers.org/babykit.html

Re: Creating custom signatures

HITSSEC — Thu, 13 Nov 2014 19:23:16 GMT

Lewis and mmarceli,

You are partially correct. The pattern match with the context http-req-uri-path should contain only the path after the domain name. In the example above it may be a bit confusing. If you want to block all connections to URLs containing /babykit.html then you probably should have a pattern of /babykit\.html since the "." is a wildcard character the "\" preceding it indicates that we want to match against a period "." The action for the signature would be a reset probably.

Hope this helps

Phil