signature based http-req-message-body

[NoamRotter]

HI all,

I'm trying to create a custom signature based on the POST payload the client is sending.

This is the POST collected from the server:

POST /pds HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: https://aaa.com.cn
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: aaa.com.cn
Content-Length: 276
Connection: Keep-Alive
Cache-Control: no-cache
X-Forwarded-Proto:https
Cookie: __Secure-UqZBpD3n3keyY3Yp6VvxpmySSbQF5o9Gf5ec6w__=v1FKp4gw__Zls


func=login&calling_system=primo&term1=short&institute=12ABC&selfreg=&bor_id=1&bor_verification=1&url=http%3A%2F%2Faaa.com.cn%2Ftransition%3FtargetUrl%3Dhttp%253A%252F%252Faaa.com.cn%252Fhelp%252Fcontent%253Fid%253DmyLibrary

I am trying to create a signature that will alert each time the payload contains:

"func=login&calling_system=primo&term1=short&institute="

Can you guide me through the configuration?

Thanks in advanced,

Noam.

[nikoolayy1]

You may see this post for how to try regex match https://live.paloaltonetworks.com/t5/custom-signatures/custom-vulnerability-to-block-old-browser-ver... as the regex match should be added in ( ).