RegEx - Pattern Match

[mrsold]

Hey everyone,

I'm attempting to build a pattern match for a custom vulnerability.  Here are the criteria:

• File is always a random 24 character file with a '.exe' extension
• First three characters are always 'e54'

I had the following regex built, but the PA doesn't like it for some reason.

(e54([a-zA-Z0-9]{21})\.exe)

It gives me some invalid character internal error.  Any thoughts?

[HULK]

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

[mrsold]

HULK wrote:

Hello mrsold,

A Pattern must be at least 7 bytes. In the entire pattern there must exist at least one 7 byte string that has fixed values.

Regular expression syntax for patterns in custom app signatures

Thanks

Thanks Hulk. 

Am I counting wrong?  I thought that string I posted is at least 7 bytes.

[HULK · Accepted solution]

Hello mrsold,

There should be a continuous 7 byte string.

Examples

-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.

->  'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte

        -> foo.*bar.*foobarfoo   (invalid)

        ->  foo.*fooba       (valid)

Hope this helps.

Thanks

[mrsold]

HULK wrote:

Hello mrsold,

There should be a continuous 7 byte string.
Examples
-> pattern -> a -> regex 'abc[abc]{3}abc.*abc' is invalid.
->  'abc.{3}abcdefg.*abc' ----is valid >>>>>>>> 7 byte
        -> foo.*bar.*foobarfoo   (invalid)
        ->  foo.*fooba       (valid)

Hope this helps.

Thanks

Ah yes, the continuous is a very important part.

Thanks!

[Mariusz.pianka]

Hi Guys,

I'm trying to create the pattern to reset the connection if the connection comes from Internet Explorer.

I took PCAP with wireshark and user-agent shows as : "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (there is \r\n at the end but I think its wireshark? )

Nevertheless

I copied my text to RegExr; and did my regular expression to match.

.*Mozilla\/5\.0\s\(Windows\sNT\s6\.1\;\sWOW64\;\sTrident\/7\.0\;\srv\:11\.0\)\slike\sGecko

it highlights the text, meaning It is a valid expression, Palo Alto takes it, and while I was troubleshooting I even got some hits but internet explorer works as normal.

Can you tell if this is even possible?

[Alvan_Lee]

Hello,

I know this is an old thread but anyone knows why this particular string is not accepted as a pattern for SNI with ssl client hello as context? It keeps telling me it has to be at least 7 byte long.

www.gsop.avxeur.com

gsop.avxeur.com

avx.eur.com

All the above cannot go through..

i randomly try youtube.com, singtel.com, asiaone.com, all is ok.

Hope somone can help! Thanks!