About phi1771

phi1771 · ‎07-14-2017

Looks like my issue was due to spaces on the hex indicators and I was using /x instead of \x. It worked after modifying the pattern match to the below, \x3531333438623763302d646432372d313164662d393337622d3038303032303063396136362e73332e616d617a6f6e6177732e636f6d\x

phi1771 · ‎07-13-2017

Hi, I'm attempting to create an application signature to detect Amazon AWS backups. I captured SSL client hello packets to get the the below hex for the pattern match, but signature is not fireing. Packet, Hex value, /x 3531333438623763302d646432372d313164662d393337622d3038303032303063396136362e73332e616d617a6f6e6177732e636f6d /x Signature condition match,

phi1771 · ‎02-09-2015

Hello, Wondering if anyone can assist in developing a custom threat signature to detect inbound web request with this particular regex within the URI string? .*(?:[{(]|%7B|% 28 ).*(?:[})]|%7D|% 29 ).* All attempts have came up with syntax errors

Member Since	‎07-27-2011 07:03 PM
Date Last Visited	‎06-27-2022 07:06 PM
Posts	3

Online Status	Offline
Date Last Visited	‎06-27-2022 07:06 PM

About phi1771

Re: Custom Signature Help

Custom Signature Help

Help Creating Custom Vulnerability Signature To Detect Specific URI String

Re: Custom Signature Help

Custom Signature Help

Help Creating Custom Vulnerability Signature To Detect Specific URI String