Creating custom signatures

[mmarceli]

Is there a way to create a signature to block or alert as referenced by this website...

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=27208

The sample url comes from the link below

http://l.facebook.com/l/8AQEvKJix/christmasoffers.org/babykit.html

If this signature is already in the latest updates, please let us know.

[lewis · Accepted solution]

You could create a custom vulnerability signature, in this case for http://l.facebook.com/l/8AQEvKJix/christmasoffers.org/babykit.html you could accomplish it by creating a http-req-uri-path signature with christmasoffers.org/babykit.html

[HITSSEC]

Lewis and mmarceli,

You are partially correct. The pattern match  with the context http-req-uri-path should contain only the path after the domain name.  In the example above it may be a bit confusing.  If you want to block all connections to URLs containing /babykit.html then you probably should have a pattern of  /babykit\.html   since the "." is a wildcard character the "\" preceding it indicates that we want to match against a period "."   The action for the signature would be a reset probably.

Hope this helps

Phil