DNS full domain matching within the dns_query buffer
There have been a few scenarios in which the following pcre has been applied to a rule -> "/(?:^|\.)google.com$/" and I was curious to know if we can make this a keyword for DNS signatures.
The idea behind this is that when we have a domain, ex. 'google.com', we want to match on either 'google.com' or 'subdomain.google.com' but not something such as 'agoogle.com'.
Example rule structure with the new keyword:
dns_query; content:"google.com"; full_domain; pcre:"/(?:^|\.)google.com$/";
google.com - Match
hello.google.com - Match
hey.agoogle.com - No match
agoogle.com - No match
Updated by Victor Julien 14 days ago
- Status changed from New to Assigned
- Assignee changed from Community Ticket to Jeff Lucovsky
- Target version changed from 5.0beta1 to 5.0rc1
I think this can be easily implemented using the transform API.
Jeff, could you implement 2 transforms:
tld -> this will transform an input buffer of example.com to just com domain -> this will transform an input buffer of subdomain.example.com to just example.com
The rule would look like:
alert dns any any -> any any (dns.query; tld; content:"com"; sid:1;) alert http any any -> any any (http.host; domain; content:"example.com"; startswith; sid:2;)
Have a look at the exist transforms for how to use this API: strip_whitespace, to_md5, etc.