topic Custom signature for Wordpress in General Topics

Custom signature for Wordpress

LarsOlav — Sat, 12 Jul 2014 10:50:57 GMT

I am fairly new to custom signature in Palo Alto, just so you are warned. I am trying to create a vulnerability signature for detecting wordpress.

The Get request will contain /? followed by 5 digits or more. User agent will be wordpress/ followed by version number.

My plan was to create one signature with one condition for User-agent ( http-req-headers with pattern match 'wordpres/' ) and one for the Get request ( http-req-uri-path with pattern match 'GET /?amp' ) .

The problem I have is that the get request contains too few fixed charters. Any suggestions on how to get around this ?

Re: Custom signature for Wordpress

pulukas — Sat, 12 Jul 2014 13:29:00 GMT

There really is no way around the limit. You need to either forgo that test or find a longer string.

Generally this limit is there to prevent false positives that come with very short tests.

Re: Custom signature for Wordpress

LarsOlav — Sun, 13 Jul 2014 05:13:29 GMT

Hi Steven,

Thank you for your support.

Would it be possible to combine GET request and User-agent in one condition? I have tried but are getting DFA error.

/Lars Olav

Re: Custom signature for Wordpress

pulukas — Sun, 13 Jul 2014 13:54:42 GMT

I don't think you can combine these two. If I understand what you are detecting correctly, the agent will be a request header and the other is a parameter header so they are check in different sections.

I assume you have seen this documentation on creating regex by section, if not, it may be helpful.

Creating Custom Threat Signatures

Re: Custom signature for Wordpress

LarsOlav — Sun, 13 Jul 2014 14:00:56 GMT

Thank you for your reply. Yes I am familiar with the document. I was hoping that I had overlooked a solution here, but I understand that I have to find a different solution.