Project

General

Profile

Actions

Feature #776

open

Task #6473: detect: smtp keyword coverage

rules: Add smtp_envelope and smtp_header keywords

Added by David André about 11 years ago. Updated 6 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Beginner

Description

Add smtp_envelope and smtp_header keywords.

The envelope is composed of communication before the DATA segment ( example at http://en.wikipedia.org/wiki/SMTP#SMTP_transport_example) and the header is the part of the email content before there is the mail body (which should be anything between DATA and the first occurence of CR LF CR LF).

The idea is to allow rules searching for email addresses, mail user-agents, etc.. while not matching on the same pattern(s) being discussed in an email body.


Related issues 3 (3 open0 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #6198: Feature Request: Add "SMTP" keywords for use in rulesNewOISF DevActions
Related to Suricata - Feature #3487: multi-part parser in RustIn ReviewPhilippe AntoineActions
Actions #1

Updated by Victor Julien about 11 years ago

I have some test code for this, let me try to find it and see if it in usable shape.

Actions #2

Updated by Christophe Vandeplas over 10 years ago

Email subject and attachment names are also very interesting keywords

Do consider that data need to be normalized as the data:
  • can be split in multiple lines
  • can be encoded following RFC2047 ( From: =?US-ASCII?Q?Keith_Moore?= <moore@cs.utk.edu> , Subject: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?= )
Actions #3

Updated by Victor Julien over 10 years ago

  • Target version set to TBD
Actions #4

Updated by Andreas Herz over 8 years ago

  • Assignee set to OISF Dev
Actions #5

Updated by Victor Julien almost 6 years ago

  • Assignee changed from OISF Dev to Anonymous
  • Effort set to medium
  • Difficulty set to low
Actions #6

Updated by Andreas Herz about 5 years ago

  • Assignee set to Community Ticket
Actions #7

Updated by Victor Julien over 4 years ago

  • Label Beginner added
Actions #8

Updated by Victor Julien over 3 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #9

Updated by Victor Julien over 3 years ago

  • Subject changed from Add smtp_envelope and smtp_header keywords to rules: Add smtp_envelope and smtp_header keywords
Actions #10

Updated by Victor Julien over 1 year ago

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to OISF Dev
  • Effort deleted (medium)
  • Difficulty deleted (low)
Actions #11

Updated by Victor Julien 10 months ago

  • Related to Feature #6198: Feature Request: Add "SMTP" keywords for use in rules added
Actions #12

Updated by Philippe Antoine 9 months ago

Actions #13

Updated by Victor Julien 6 months ago

  • Parent task set to #6473
Actions

Also available in: Atom PDF