topic Re: RegEx - Pattern Match in Automation/API Discussions

RegEx - Pattern Match

mrsold — Fri, 24 Oct 2014 12:29:44 GMT

Hey everyone,

I'm attempting to build a pattern match for a custom vulnerability. Here are the criteria:

File is always a random 24 character file with a '.exe' extension
First three characters are always 'e54'

I had the following regex built, but the PA doesn't like it for some reason.

(e54([a-zA-Z0-9]{21})\.exe)

It gives me some invalid character internal error. Any thoughts?

Re: RegEx - Pattern Match

HULK — Fri, 24 Oct 2014 12:33:22 GMT

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

Re: RegEx - Pattern Match

mrsold — Fri, 24 Oct 2014 16:18:08 GMT

HULK wrote:

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

Thanks Hulk.

Am I counting wrong? I thought that string I posted is at least 7 bytes.

Re: RegEx - Pattern Match

HULK — Fri, 24 Oct 2014 16:24:30 GMT

Hello mrsold,

There should be a continuous 7 byte string.

Examples

-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.

-> 'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte

-> foo.*bar.*foobarfoo (invalid)

-> foo.*fooba (valid)

Hope this helps.

Thanks

Re: RegEx - Pattern Match

mrsold — Fri, 24 Oct 2014 16:45:28 GMT

HULK wrote:

Hello mrsold,

There should be a continuous 7 byte string.
Examples
-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.
->  'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte
        -> foo.*bar.*foobarfoo   (invalid)
        ->  foo.*fooba       (valid)

Hope this helps.

Thanks

Ah yes, the continuous is a very important part.

Thanks!

Re: RegEx - Pattern Match

Mariusz.pianka — Sun, 08 Mar 2015 03:01:03 GMT

Hi Guys,

I'm trying to create the pattern to reset the connection if the connection comes from Internet Explorer.

I took PCAP with wireshark and user-agent shows as : "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (there is \r\n at the end but I think its wireshark? )

Nevertheless

I copied my text to RegExr; and did my regular expression to match.

.*Mozilla\/5\.0\s\(Windows\sNT\s6\.1\;\sWOW64\;\sTrident\/7\.0\;\srv\:11\.0\)\slike\sGecko

it highlights the text, meaning It is a valid expression, Palo Alto takes it, and while I was troubleshooting I even got some hits but internet explorer works as normal.

Can you tell if this is even possible?

Re: RegEx - Pattern Match

Alvan_Lee — Fri, 22 Feb 2019 03:27:34 GMT

Hello,

I know this is an old thread but anyone knows why this particular string is not accepted as a pattern for SNI with ssl client hello as context? It keeps telling me it has to be at least 7 byte long.

www.gsop.avxeur.com

gsop.avxeur.com

avx.eur.com

All the above cannot go through..

i randomly try youtube.com, singtel.com, asiaone.com, all is ok.

Hope somone can help! Thanks!