Logical conditions in custom IPS signatures

[santonic]

Hello.

I need some help with logical conditions in custom IPS signatures definitions.

I've made a set of custom IPS signatures for browser identification based on user agent strings. the were working ok, but recently MS decided that IE will not include string MSIE in some cases. So I'm making a new signature which will try to find MSIE or Trident (a string which only IE of major browsers uses).

Currently I have old signature which searches for MSIE and is working ok:

Now I made a new signature which should trigger on MSIE OR Trident string:

But the second signature never triggers. Why? It should trigger on the same user agent strings as first one and more.

I'm also curious if some other ppl are trying to make (and maintain) browser identification signatures. Or if someone knows a trustworthy source of regular expressions for user agents.

[santonic]

Nevermind this, the configuration was correct, my diagnostics weren't.

[HITSSEC]

Thanks for the update Santonic as I could see nothing wrong and was about to say "time for the wireshark packet capture to see what the available data looks like".  Good luck with your signatures. I have written a lot over the past 2 years and they have proven to be useful.

Phil

[santonic]

Thank you for effort. What signatures are you making? For browser ID?

[HITSSEC]

Asntonic

We have written signatures for malicious intended web requests and to block the downloading of specific files (adware, toolbars, undesired software).

Phil