Snort mailing list archives
RE: Dectecting Social Security Numbers?
From: "Harper, Patrick" <patrick.harper () phns com>
Date: Fri, 10 Sep 2004 15:10:14 -0500
I use: alert ip $HOME_NET any -> $EXTERNAL_NET any (pcre:"/[1-9]{3,3}[-][1-9]{2,2}[-][1-9]{4,4}/"; msg:"SSN# in clear text"; classtype:policy-violation; sid:2000370; rev:2;) Works for me -----Original Message----- From: Lyons, Jon [mailto:Jon_Lyons () enh org] Sent: Friday, September 10, 2004 1:02 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Dectecting Social Security Numbers? I'm trying to get snort to generate an alert for SS#'s, I've tried the rule below but no alerts are generated. I tested this with pcretest and it works...am I missing something? alert tcp any any -> any any (msg:"Socail Security Number Clear Text"; pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";) Disclaimer: This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Dectecting Social Security Numbers? Lyons, Jon (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Re: Stealth network card sekure (Sep 10)
- Stealth network card Carlos M Ospina (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Re: Dectecting Social Security Numbers? Adam Levy (Sep 10)
- <Possible follow-ups>
- Re: Dectecting Social Security Numbers? Dan Fiorito (Sep 10)
- RE: Dectecting Social Security Numbers? Harper, Patrick (Sep 10)
- Message not available
- RE: Dectecting Social Security Numbers? Matt Kettler (Sep 10)
- Message not available
- Re: Dectecting Social Security Numbers? Brian (Sep 10)