About custom vulnerability signature

[KiCheon.Lee]

Hello,

My customer made vulnerability signature in FW. But FW doesn't detect this signature.

Customer Vulnerability Signature

context : http-req-message-body

pattern : eval\(gzinflate\(str_rot13\(base64_decode

I am searching this but I don't know.

So I need your assistance for it.

I have read Creating_Custom_Signatures-RevA.pdf document   

This document describe as the following message.

http-req-message-body

Description: Body content of a HTTP request when the body content cannot be recognized as URL encoded or MIME type data using the Content-type field.

Do you know to relate between not detecting signature and this description??

Thanks

[kadak]

Hello cheon,

Your question would be best answered in the following community : DevCenter

Thanks and regards,

Kunal Adak

[KiCheon.Lee]

OK, Kunal Adak.

Thanks.