03-28-2023 03:37 AM
I'm trying to create a custom signature based on the POST payload the client is sending.
This is the POST collected from the server:
POST /pds HTTP/1.1 Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */* Referer: https://aaa.com.cn Accept-Language: zh-CN User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0) Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Host: aaa.com.cn Content-Length: 276 Connection: Keep-Alive Cache-Control: no-cache X-Forwarded-Proto:https Cookie: __Secure-UqZBpD3n3keyY3Yp6VvxpmySSbQF5o9Gf5ec6w__=v1FKp4gw__Zls func=login&calling_system=primo&term1=short&institute=12ABC&selfreg=&bor_id=1&bor_verification=1&url=http%3A%2F%2Faaa.com.cn%2Ftransition%3FtargetUrl%3Dhttp%253A%252F%252Faaa.com.cn%252Fhelp%252Fcontent%253Fid%253DmyLibrary
I am trying to create a signature that will alert each time the payload contains:
Can you guide me through the configuration?
Thanks in advanced,
04-03-2023 07:12 AM
You may see this post for how to try regex match https://live.paloaltonetworks.com/t5/custom-signatures/custom-vulnerability-to-block-old-browser-ver... as the regex match should be added in ( ).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!