Project

General

Profile

Actions
Copy link

Bug #5176

open
BM OD

False positive when negated content is far ahead of matching content.

Bug #5176: False positive when negated content is far ahead of matching content.

Added by Brandon Murphy over 4 years ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
5.0.8, 6.0.4, 8.0.0
Effort:
Difficulty:
Label:

Description

In looking at alerts for a signature designed to detect powershell command line options returned by http servers, but not part of an HTML page, many false positives were discovered. I have been able to able to reliability reproduce the False Positive alert with the attached pcap gathered from any.run.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"test with http buffers - SHOULD NOT ALERT"; flow:established,from_server; http.response_body; content:!"<html"; content:"-ExecutionPolicy"; nocase; sid:1;)

Files

f38cbd74-d97e-4b1a-94d9-527eb4a7ad3f.pcap (720 KB) f38cbd74-d97e-4b1a-94d9-527eb4a7ad3f.pcap Brandon Murphy, 03/06/2022 03:07 AM
Actions
Copy link

Also available in: PDF Atom