Actions
Bug #148
closedsid:2002908 should fire when processing the attached pcap but doesn't.
Affected Versions:
Effort:
Difficulty:
Label:
Description
src/suricata -c suricata.yaml -r /home/coz/suricata35.pcap -l ./ -s blah.rules
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT x86 JmpCallAdditive Encoder"; content:"|FC BB|"; content:"|EB 0C 5E 56 31 1E AD 01 C3 85 C0 75 F7 C3 E8 EF FF FF FF|"; distance: 4; within: 19; classtype:shellcode-detect; reference:url,doc.emergingthreats.net/bin/view/Main/2002908; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_Metasploit_Encoders; sid:2002908; rev:4;)
bytes in packet no 98:
fc bb 8e a1 22 4a eb 0c 5e 56 31 1e ad 01 c3 85 c0 75 f7 c3 e8 ef ff ff ff
Files
Updated by Victor Julien almost 14 years ago
- Assignee changed from OISF Dev to Victor Julien
Updated by Victor Julien almost 14 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100
Issue was caused by broken within calculation. Fixed.
Actions