RegEx - Pattern Match

[mrsold]

Hey everyone,

I'm attempting to build a pattern match for a custom vulnerability.  Here are the criteria:

• File is always a random 24 character file with a '.exe' extension
• First three characters are always 'e54'

I had the following regex built, but the PA doesn't like it for some reason.

(e54([a-zA-Z0-9]{21})\.exe)

It gives me some invalid character internal error.  Any thoughts?

[Mariusz.pianka]

Hi Guys,

I'm trying to create the pattern to reset the connection if the connection comes from Internet Explorer.

I took PCAP with wireshark and user-agent shows as : "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (there is \r\n at the end but I think its wireshark? )

Nevertheless

I copied my text to RegExr; and did my regular expression to match.

.*Mozilla\/5\.0\s\(Windows\sNT\s6\.1\;\sWOW64\;\sTrident\/7\.0\;\srv\:11\.0\)\slike\sGecko

it highlights the text, meaning It is a valid expression, Palo Alto takes it, and while I was troubleshooting I even got some hits but internet explorer works as normal.

Can you tell if this is even possible?

[Alvan_Lee]

Hello,

I know this is an old thread but anyone knows why this particular string is not accepted as a pattern for SNI with ssl client hello as context? It keeps telling me it has to be at least 7 byte long.

www.gsop.avxeur.com

gsop.avxeur.com

avx.eur.com

All the above cannot go through..

i randomly try youtube.com, singtel.com, asiaone.com, all is ok.

Hope somone can help! Thanks!