Actions
Bug #720
closedfile keywords - rule grammar - double quotes
Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
alert http any any -> any any (msg:"FILE Check PDF "; fileext:"pdf"; filestore; sid:9999993; rev:2;) alert http any any -> any any (msg:"FILE Check PDF "; fileext:pdf; filestore; sid:9999994; rev:2;)
both rules above load - notice the missing double quotes around fileext:pdf.
This is the case with most of the file keywords.
Actions