[Snort-users] Dectecting Social Security Numbers?

Lyons, Jon Jon_Lyons at ...11066...
Fri Sep 10 13:19:01 EDT 2004


Thanks, I've tried multiple rules, but this one works the best...

Thanks!

-----Original Message-----
From: Harper, Patrick [mailto:patrick.harper at ...11593...] 
Sent: Friday, September 10, 2004 3:10 PM
To: Lyons, Jon; snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Dectecting Social Security Numbers?

I use:

alert ip $HOME_NET any -> $EXTERNAL_NET any
(pcre:"/[1-9]{3,3}[-][1-9]{2,2}[-][1-9]{4,4}/"; msg:"SSN# in clear
text"; classtype:policy-violation; sid:2000370; rev:2;)  


Works for me
 
-----Original Message-----
From: Lyons, Jon [mailto:Jon_Lyons at ...11066...] 
Sent: Friday, September 10, 2004 1:02 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Dectecting Social Security Numbers?

 
I'm trying to get snort to generate an alert for SS#'s, I've tried the
rule below but no alerts are generated. I tested this with pcretest and
it works...am I missing something?
alert tcp any any -> any any (msg:"Socail Security Number Clear Text";
pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)




Disclaimer:
This electronic message, including any attachments, is confidential and
intended solely for use of the intended recipient(s). This message may
contain information that is privileged or otherwise protected from
disclosure by applicable law. Any unauthorized disclosure,
dissemination, use or reproduction is strictly prohibited. If you have
received this message in error, please delete it and notify the sender
immediately. 







More information about the Snort-users mailing list