[Snort-users] Snort rule to detect Windows PE Executable Downloads

Humes, David G. David.Humes at ...383...
Thu Jul 12 22:04:56 EDT 2007


I realize my question was a bit long winded.  Let's try something
simpler.

I think this rule should be highly effective in detecting the download
of a Windows PE executable file.

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"PE Executable
Download"; content:"MZ"; depth:2; byte_jump:4,60,little,from_beginning;
content:"PE|00 00|"; within:4; flow:established,from_server;
sid:8000143; classtype:bad-unknown; rev:1;)

It works this executable, http://www.cygwin.com/setup.exe, but not using
this,  http://the.earth.li/~sgtatham/putty/0.60/x86/putty.exe.  Why?
Could anyone try it on their sensors and let me know if it behaves any
differently.  Or if anyone has any suggestions on how to do this that
does not involve matching the "!This program cannot be run in DOS mode."
string, that would be appreciated.  Sorry Matt, I just don't think you
can depend on that string any more.  

I will take a look at the PEHunter plugin that Jamie suggests.  But, I
think the rule, or something very similar, should work in all cases.

Thanks.

--Dave





More information about the Snort-users mailing list