topic Re: Custom Pattern and Signatures without hex in General Topics

Custom Pattern and Signatures without hex

mhuels — Mon, 09 May 2011 15:19:09 GMT

I am wondering not beeing able to declare hexadecimal data in custom pattern/signatures. Perhaps i am in mistake, but i found nowhere any complete explanation of "building regex with Palo Alto systems".

For instance, i did not found the solution to declare "<" in a pattern regex ( "<" or "\<" don't work) or "Beginning of the file" (perhaps "^" ?).

greetings

Manfred

Re: Custom Pattern and Signatures without hex

fredallee — Mon, 09 May 2011 16:11:55 GMT

For hex patterns in custom sigs use "\x" at the beginning of the hex pattern, then "\x" at the end of the hex pattern. For example: .*\x42 3f 36 2b 7a 70 49 50 44 35 39 77 3d 3d 3f 3d\x. We will work on get this into the admin guide.

Alfred

Re: Custom Pattern and Signatures without hex

mhuels — Tue, 10 May 2011 10:46:13 GMT

Hi Alfred,

do you know the method to declare "Beginning of file" ? Am i right to guess, that "\x41 6c 66 72 65 64\x" without ".*" is "Alfred" at the very beginning?

mfg

Manfred