[Snort-sigs] Alerts for OOXML and MOX

Will will71110 at yahoo.com
Sun Sep 3 10:01:10 EDT 2017

    I am pretty new to the Snort world.  I am wondering if it is possible to create an alert that can look inside OOXML or MOX type formats to find clear text content.  The thing about these file types are they are compressed files with it's own  file structure within the file.  What I am aiming at doing is to have an snort alert look for people trying to off load (Copy) lots of sensitive data (Like Social Security Numbers) from these type files.  One alert I created looks like this.
alert tcp any any -> any any (msg:"Sensitive Info being Accessed"; pcre:"/\d{3}\-\d{2}\-\d{4}/"; sid: 100001)
But this alert only works for things like text files.
I am thinking there might have to be a preprocessing for this to work?  Is there something like this out there?

- Will
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20170903/e06f62b9/attachment.html>

More information about the Snort-sigs mailing list