Project

General

Profile

Actions

Bug #7356

open

Unexpected effect of filestore keyword

Added by Eric Leblond 3 days ago. Updated 2 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

If we take the two following signatures on a pcap file where exe file are downloaded over http, then the first one (sid 1) is matching but the second is not:

alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; sid:1; rev:1;)
alert http any any -> any any (msg:"exe"; http.uri; content:"exe"; filestore; sid:2; rev:1;)

We have no file in the direction of http.uri but from documentation filestore should not prevent the match.

Tested on 6, 7 and master.


Related issues 1 (1 open0 closed)

Related to Suricata - Bug #7357: filestore keyword option seems not to workIn ProgressEric LeblondActions
Actions

Also available in: Atom PDF