Project

General

Profile

Actions
Copy link

Bug #720

closed

file keywords - rule grammar - double quotes

Added by Peter Manev over 11 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

alert http any any -> any any (msg:"FILE Check PDF "; fileext:"pdf"; filestore; sid:9999993; rev:2;)
alert http any any -> any any (msg:"FILE  Check PDF "; fileext:pdf; filestore; sid:9999994; rev:2;)

both rules above load - notice the missing double quotes around fileext:pdf.
This is the case with most of the file keywords.

Actions
Copy link

Also available in: Atom PDF