Project

General

Profile

Actions

Feature #2486

open

Task #4380: tracking: improvements to bits, ints, vars

prefilter/fast_pattern logic for flowbits

Added by Jason Williams almost 5 years ago. Updated 3 months ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

It would be useful to have a way to indicate that a rule with a flowbit check should only be checked in the event that the set flowbit appears in the flow.

This could reduce the number of checks on signatures with poor fast_pattern candidates and time spent matching only to throw away the match because the flowbit was not present.

For example:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS HTTP POST Form Observed After Successful Credential Theft"; flowbits:isset,ET.genericphish; file_data; content:"method=|22|post|22|"; nocase; sid:123; rev:1;)

This rule can be very useful for generic phish detection, but because the only content we're looking for is the post, we incur lots and lots of checks as thats the only available match for fast_pattern


Related issues 3 (3 open0 closed)

Related to Task #2685: SuriCon 2018 brainstormAssignedVictor JulienActions
Related to Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Actions

Also available in: Atom PDF