Snort mailing list archives
Re: Snort rule to detect Windows PE Executable Downloads
From: "Humes, David G." <David.Humes () jhuapl edu>
Date: Thu, 12 Jul 2007 22:04:56 -0400
I realize my question was a bit long winded. Let's try something simpler. I think this rule should be highly effective in detecting the download of a Windows PE executable file. alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"PE Executable Download"; content:"MZ"; depth:2; byte_jump:4,60,little,from_beginning; content:"PE|00 00|"; within:4; flow:established,from_server; sid:8000143; classtype:bad-unknown; rev:1;) It works this executable, http://www.cygwin.com/setup.exe, but not using this, http://the.earth.li/~sgtatham/putty/0.60/x86/putty.exe. Why? Could anyone try it on their sensors and let me know if it behaves any differently. Or if anyone has any suggestions on how to do this that does not involve matching the "!This program cannot be run in DOS mode." string, that would be appreciated. Sorry Matt, I just don't think you can depend on that string any more. I will take a look at the PEHunter plugin that Jamie suggests. But, I think the rule, or something very similar, should work in all cases. Thanks. --Dave ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort rule to detect Windows PE Executable Downloads Humes, David G. (Jul 12)
- Re: Snort rule to detect Windows PE Executable Downloads Jeffrey Denton (Jul 12)
- Re: Snort rule to detect Windows PE Executable Downloads Humes, David G. (Jul 12)
- Re: Snort rule to detect Windows PE ExecutableDownloads Paul Melson (Jul 12)
- Re: Snort rule to detect Windows PE ExecutableDownloads Matt Jonkman (Jul 12)
- Re: Snort rule to detect Windows PE Executable Downloads Humes, David G. (Jul 12)
- Re: [Snort-sigs] Snort rule to detect Windows PE Executable Downloads Matt Jonkman (Jul 12)
- Re: [Snort-sigs] Snort rule to detect Windows PE Executable Downloads Humes, David G. (Jul 13)
- Re: [Snort-sigs] Snort rule to detect Windows PE Executable Downloads Will Metcalf (Jul 13)
- Re: [Snort-sigs] Snort rule to detect Windows PE Executable Downloads Matt Jonkman (Jul 12)
- Re: Snort rule to detect Windows PE Executable Downloads Jeffrey Denton (Jul 12)