Project

General

Profile

Feature #3074

DNS full domain matching within the dns_query buffer

Added by James Emery-Callcott 17 days ago. Updated 14 days ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
low
Label:

Description

Hey folks,

There have been a few scenarios in which the following pcre has been applied to a rule -> "/(?:^|\.)google.com$/" and I was curious to know if we can make this a keyword for DNS signatures.

The idea behind this is that when we have a domain, ex. 'google.com', we want to match on either 'google.com' or 'subdomain.google.com' but not something such as 'agoogle.com'.

Example rule structure with the new keyword:

dns_query; content:"google.com"; full_domain; pcre:"/(?:^|\.)google.com$/";

google.com - Match
hello.google.com - Match
hey.agoogle.com - No match
agoogle.com - No match

History

#1

Updated by James Emery-Callcott 17 days ago

Edit - ignore the PCRE in the example rule structure, typo on my part.

#2

Updated by Andreas Herz 15 days ago

  • Assignee set to Community Ticket
#3

Updated by Victor Julien 14 days ago

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to Jeff Lucovsky
  • Target version changed from 5.0beta1 to 5.0rc1

I think this can be easily implemented using the transform API.

Jeff, could you implement 2 transforms:

tld -> this will transform an input buffer of example.com to just com
domain -> this will transform an input buffer of subdomain.example.com to just example.com

The rule would look like:
alert dns any any -> any any (dns.query; tld; content:"com"; sid:1;)
alert http any any -> any any (http.host; domain; content:"example.com"; startswith; sid:2;)

Have a look at the exist transforms for how to use this API: strip_whitespace, to_md5, etc.

Also available in: Atom PDF