Re: Content "c:"

[Erek Adams <erek () theadamsfamily net>]

On Tue, 19 Jun 2001, Sheahan, Paul (PCLN-NW) wrote:

> I'm trying to create a rule that searches for content of "c:" in packets.
> But Snort complains that a closing quote is needed. In a prior posting I had
> asked about "c:\" and someone mentioned the backslash was a problem. Even
> without the backslash this still fails. Ths is the latest test rule I tried:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Outgoing c:"; content:
> "c:"; nocase;)
>
> Snort complains that content needs an ending quote. Apparently the colon
> after the "c" is what is messing this up. Does anyone know how to make a
> content rule with "c:" or any drive letter as the content?

Paul,

        Have a look at the attached message.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net

Attachment: meep
Description: