开发者

snort rule: logging access to site containing the word "Malware"

开发者 https://www.devze.com 2022-12-22 19:03 出处:网络
I 开发者_C百科am trying to create a rule for snort to basically log any packets once a user tries to access a page with the word \"malware\" in it. This is what I have, just asking for some guide. So

I 开发者_C百科am trying to create a rule for snort to basically log any packets once a user tries to access a page with the word "malware" in it. This is what I have, just asking for some guide. So basically once a webpage contains the phrase it shows an alert.

 alert tcp any any -> any any
 (content:"malware";
  msg:"Someone clone is accessing a page with malware tagged!!!!";
  aid:10000002;rev:1;)


alert tcp any any -> any any (content:"malware"; msg:"Someone clone is accessing a page with malware tagged!!!!"; aid:10000002;rev:1;)

Actually worked and the problem was solved

0

精彩评论

暂无评论...
验证码 换一张
取 消