[Snort-sigs] Rule Edit: COMMUNITY BOT GTBot ver command

Blake Hartstein bhartstein at ...274...
Fri Oct 20 18:50:17 EDT 2006


Hi,
In favor of better performance, you can use a negative look behind 
instead of a direct negative match as the first check in a pcre. This 
allows the pcre check to finish quicker. I felt this was particularly 
important if you want to use this rule, since it happens to look on any 
port.

Before: (avg/check 427.9 microseconds)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
ver command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"ver"; pcre:"/[^a-zA-Z0-9\x3A\s]ver/"; classtype: 
trojan-activity; sid:100000272; rev:2;)

After: (avg/check 28.3 microseconds)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
ver command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"ver"; pcre:"/(?<![a-zA-Z0-9\x3A\s])ver/"; classtype: 
trojan-activity; sid:100000272; rev:3;)


This improvement applies to :
100000272               "/[^a-zA-Z0-9\x3A\s]ver/"
100000273               "/[^a-zA-Z0-9\x3A\s]info/"
100000274               "/[^a-zA-Z0-9\x3A\s]scan/"
100000275               "/[^a-zA-Z0-9\x3A\s]portscan/"
100000276               "/[^a-zA-Z0-9\x3A\s]stopscan/"
100000277               "/[^a-zA-Z0-9\x3A\s]packet/"
100000278               "/[^a-zA-Z0-9\x3A\s]bnc/"

The new rules are:
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
ver command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"ver"; pcre:"/(?<![a-zA-Z0-9\x3A\s])ver/"; classtype: 
trojan-activity; sid:100000272; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
info command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"info"; pcre:"/(?<![a-zA-Z0-9\x3A\s])info/"; classtype: 
trojan-activity; sid:100000273; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
scan command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"scan"; pcre:"/(?<![a-zA-Z0-9\x3A\s])scan/"; classtype: 
trojan-activity; sid:100000274; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
portscan command"; flow: established; 
flowbits:isset,community_is_proto_irc; content:"portscan"; 
pcre:"/(?<![a-zA-Z0-9\x3A\s])portscan/"; classtype: trojan-activity; 
sid:100000275; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
stopscan command"; flow: established; 
flowbits:isset,community_is_proto_irc; content:"stopscan"; 
pcre:"/(?<![a-zA-Z0-9\x3A\s])stopscan/"; classtype: trojan-activity; 
sid:100000276; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
packet command"; flow: established; 
flowbits:isset,community_is_proto_irc; content:"packet"; 
pcre:"/(?<![a-zA-Z0-9\x3A\s])packet/"; classtype: trojan-activity; 
sid:100000277; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot 
bnc command"; flow: established; flowbits:isset,community_is_proto_irc; 
content:"bnc"; pcre:"/(?<![a-zA-Z0-9\x3A\s])bnc/"; classtype: 
trojan-activity; sid:100000278; rev:3;)



-Blake

-- 
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain information that is confidential and privileged.  If you receive this email in error, please advise us by return email immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately.  Demarc Security, Inc. does not accept liability for the views expressed in the email or for the consequences of any computer viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written consent of the copyright owner.





More information about the Snort-sigs mailing list