[Snort-sigs] Excessive alerts on SID 17407 -- Windows help file download
rmkml at ...174...
Fri Jan 27 15:56:07 EST 2012
Maybe try SF SEU update?
because this sid are on rev 10 around 7 dec 2011...
contains pcre for restrict FP.
On Fri, 27 Jan 2012, Bachelor, Stephen A CTR USSOCOM HQ wrote:
> This often triggers on content which is not a help file, such as "GET
> Is there any reason I shouldn't add, after the content rule,
> Original rule text below:
> Rule alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> (msg:"WEB-CLIENT Windows help file download request";
> flow:to_server,established; content:".hlp"; nocase; http_uri;
> metadata:policy balanced-ips drop, policy security-ips drop, service
> http; reference:cve,2006-3357; reference:cve,2006-4138;
> classtype:attempted-user; sid:17407; rev:4; )
More information about the Snort-sigs