[Snort-users] exact phrase match

Paul Schmehl pauls at ...6838...
Mon Dec 15 21:59:01 EST 2003


--On Monday, December 15, 2003 20:02:20 -0500 Brian <bmc at ...950...> wrote:
>
> Try... pcre.  :)
>
> content:"nc.exe"; pcre:"/\wnc.exe\w/";
>
Brian, you're the man, but shouldn't that be:
content:'nc.exe'; pcre:'/\Wnc.exe\W/';

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list