topic Re: Logical conditions in custom IPS signatures in Automation/API Discussions

Logical conditions in custom IPS signatures

santonic — Tue, 05 May 2015 11:32:27 GMT

Hello.

I need some help with logical conditions in custom IPS signatures definitions.

I've made a set of custom IPS signatures for browser identification based on user agent strings. the were working ok, but recently MS decided that IE will not include string MSIE in some cases. So I'm making a new signature which will try to find MSIE or Trident (a string which only IE of major browsers uses).

Currently I have old signature which searches for MSIE and is working ok:

Now I made a new signature which should trigger on MSIE OR Trident string:

But the second signature never triggers. Why? It should trigger on the same user agent strings as first one and more.

I'm also curious if some other ppl are trying to make (and maintain) browser identification signatures. Or if someone knows a trustworthy source of regular expressions for user agents.

Re: Logical conditions in custom IPS signatures

santonic — Mon, 11 May 2015 11:05:59 GMT

Nevermind this, the configuration was correct, my diagnostics weren't.

Re: Logical conditions in custom IPS signatures

HITSSEC — Wed, 13 May 2015 00:33:53 GMT

Thanks for the update Santonic as I could see nothing wrong and was about to say "time for the wireshark packet capture to see what the available data looks like". Good luck with your signatures. I have written a lot over the past 2 years and they have proven to be useful.

Phil

Re: Logical conditions in custom IPS signatures

santonic — Wed, 13 May 2015 11:51:10 GMT

Thank you for effort. What signatures are you making? For browser ID?

Re: Logical conditions in custom IPS signatures

HITSSEC — Wed, 13 May 2015 11:54:34 GMT

Asntonic

We have written signatures for malicious intended web requests and to block the downloading of specific files (adware, toolbars, undesired software).

Phil