[Snort-sigs] Excessive alerts on SID 17407 -- Windows help file download

Joel Esler jesler at ...435...
Sun Jan 29 10:39:05 EST 2012


The current rev of that rule is the following:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows help file download request"; flow:to_server,established; content:".hlp"; fast_pattern; nocase; http_uri; pcre:"/\x2ehlp([\?\x5c\x2f]|$)/smiU"; flowbits:set,file.hlp; reference:cve,2006-3357; reference:cve,2006-4138; classtype:misc-activity; sid:17407; rev:10;)

The most recent change of which was on 2011-12-01.

I suggest using pulledpork for your Rule updates:

http://blog.snort.org/2012/01/importance-of-pulledpork.html


--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

On Jan 27, 2012, at 1:58 PM, Bachelor, Stephen A CTR USSOCOM HQ wrote:

> This often triggers on content which is not a help file, such as "GET
> /iu/api/res/1.2/Ip7475OzCLIWah.hLpjbYw--/YXBwaWQ9eXZpZ"
> 
> Is there any reason I shouldn't add, after the content rule,
> pcre:"/\.hlp[^a-zA-Z0-9]/smi";
> 	
> 
> Original rule text below: 
> 
> 	Rule    alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> (msg:"WEB-CLIENT Windows help file download request";
> flow:to_server,established; content:".hlp"; nocase; http_uri;
> metadata:policy balanced-ips drop, policy security-ips drop, service
> http; reference:cve,2006-3357; reference:cve,2006-4138;
> classtype:attempted-user; sid:17407; rev:4; )
> 
> 
> 	
> 
> 
> ------------------------------------------------------------------------------
> Try before you buy = See our experts in action!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-dev2
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
> 
> 
> Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20120129/e60d7d61/attachment.html>


More information about the Snort-sigs mailing list