topic Re: Custom App-ID for XP OS? in General Topics

Custom App-ID for XP OS?

scott.smith — Mon, 28 Apr 2014 19:22:30 GMT

Has anyone written a Custom App-ID to identify XP OS, and more specifically browser based access. I would like to identify any XP, but realize I may only be able to see via browser headers.

Re: Custom App-ID for XP OS?

DavePATS — Tue, 29 Apr 2014 00:06:40 GMT

Scott,

This should be workable. The "User-Agent" header, which is part of a HTTP stream would contain this data. Looks like XP will show as the following: 'Windows XP' => '(Windows NT 5.1)|(Windows XP)',

A little testing with WireShark and some web searches should get you on your way. If you need additional help with your custom signature please reference our DevCenter via the link below.

DevCenter

Re: Custom App-ID for XP OS?

MarcoLeckel — Tue, 29 Apr 2014 09:37:24 GMT

As said before, User-Agent in HTTP Header is the only practical way to identify XP. Be aware that the User Agent may be faked.

By the way:

May be it is better to use Custom Vulnerability instead of Custom App.

This way you can identify the "Threat" XP 😉

If you use Custom App you will overwrite the whole App-Engine

which means all http Traffic will be identified as XP instead of facebook,google,youtube ......

Custom App and Custom Vulnerability work the same way when you define your own Signatures.

Regards

Marco

(edit)

There is already a sample in Dev Forum

Custom vulnerability signature for identifying Windows XP clients