Custom Pattern and Signatures without hex

[mhuels]

I am wondering not beeing able to declare hexadecimal data in custom pattern/signatures. Perhaps i am in mistake, but i found nowhere any complete explanation of "building regex with Palo Alto systems".

For instance, i did not found the solution to declare "<" in a pattern regex ( "<" or "\<" don't work) or "Beginning of the file" (perhaps "^" ?).

greetings

Manfred

[fredallee · Accepted solution]

For hex patterns in custom sigs use "\x" at the beginning of the hex pattern, then "\x" at the end of the hex pattern. For example:  .*\x42 3f 36 2b 7a 70 49 50 44 35 39 77 3d 3d 3f 3d\x. We will work on get this into the admin guide.

Alfred

[mhuels]

Hi Alfred,

do you know the method to declare "Beginning of file" ? Am i right to guess, that "\x41 6c 66 72 65 64\x" without ".*" is "Alfred" at the very beginning?

mfg

Manfred