RegEx - Pattern for strange string not work

[Passepartout]

Someone can help me for this pattern?

PATTERN:
+-----------------------------------------------------------------------+
PATTERN in Hex:
2b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2b

QUESTION : the following RegEx not work, why?
\x2b(\x2d)*\x2b

[rcole · Accepted solution]

Good morning, Passepartout.

I'll do my best to provide some opinion on the above:

\x begins a hex pattern match instead of literal string matching, and \x ends a hex pattern match, returning to literal string matching. (REF: Page 11, Custom Sig creation document in our sticky).

My interpretation of what you want your signature to look for is "2b(any number of 2d)2b" which would look like:

\x2b\x(\x2d\x)*\x2b\x

However, this is not a valid pattern match for PAN-OS due to limitations described in the custom signature creation document on page 39; there is no static seven byte pattern, and two DFAs are juxtapositioned with one another.

To illustrate what is required, I embedded your pattern in a default Apache configuration index.html, and generated a signature to look for it, with the pattern: \x2b 2d 2d 2d 2d 2d 2d 2d\x(\x2d\x)*\x2b\x matching against the context "File-html-body"

This won't match anything with less than seven "2d" consecutively, but we need a static seven byte anchor to match on PAN-OS.

See attached. I've validated the signature resets on detection. Please note this is just to illustrate what is possible, not for use. 🙂

[Passepartout]

I don't know if we talk of the same things, but my string in ASCII char is:

+-------------------------------------------------​----------------------+

and the same string in Hex char is:
2b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2b