Re: Question about xls trigger

[James Lay <jlay () slave-tothe-box net>]

On 2014-03-28 10:44, SnortFan wrote:
> Hi All,
>
> I'm seeing a lot of false positives with Excel files and I think the
> problem has to do with the way flowbits sets .xls files. Both SID
> 15463 and 19166 set 'file.xls', however it seems that 15463 is
> unnecessary considering 19166. Under what circumstances would 15463 
> be
> effective while 19166 fails? Are there any reasons to keep both rules
> active rather than suppressing 15463?
>
> SID 15463
> tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY
> Microsoft Office Excel file download request";
> flow:to_server,established; content:".xls"; fast_pattern:only;
> http_uri; pcre:"/x2exls([?x5cx2f]|$)/smiU"; flowbits:set,file.xls;
> flowbits:noalert; metadata:service http;
> reference:url,en.wikipedia.org/wiki/.xlsFile_formats [1];
> classtype:misc-activity; sid:15463; rev:16;)
>
> SID 19166
> tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any
> (msg:"FILE-IDENTIFY Microsoft Office Excel file magic detected";
> flow:to_client,established; file_data; content:"|D0 CF 11 E0|";
> depth:4; content:"W|00|o|00|r|00|k|00|b|00|o|00|o|00|k|00|";
> fast_pattern:only; flowbits:set,file.xls; flowbits:noalert;
> metadata:service ftp-data, service http, service imap, service pop3;
> classtype:misc-activity; sid:19166; rev:13;)
>
> I'm using ips_policy=security in my pulledpork.
>
> Thanks,
> Ed

Are these actual Excel files?  If so, then these should file...these 
rules aren't saying they are malicious, just they are Excel files.

James

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!