Feature #776: rules: Add smtp_envelope and smtp_header keywords - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #776

open

DA OD

Task #6473: detect: smtp keyword coverage

rules: Add smtp_envelope and smtp_header keywords

Feature #776: rules: Add smtp_envelope and smtp_header keywords

Added by David André about 13 years ago. Updated over 2 years ago.

Status:

Assigned

Priority:

Normal

Assignee:

OISF Dev

Target version:

TBD

Effort:

Difficulty:

Label:

Beginner

Description

Add smtp_envelope and smtp_header keywords.

The envelope is composed of communication before the DATA segment ( example at http://en.wikipedia.org/wiki/SMTP#SMTP_transport_example) and the header is the part of the email content before there is the mail body (which should be anything between DATA and the first occurence of CR LF CR LF).

The idea is to allow rules searching for email addresses, mail user-agents, etc.. while not matching on the same pattern(s) being discussed in an email body.

Related issues 3 (2 open — 1 closed)

VJ Updated by Victor Julien about 13 years ago Actions
Copy link
#1

I have some test code for this, let me try to find it and see if it in usable shape.

CV Updated by Christophe Vandeplas over 12 years ago Actions
Copy link
#2

Email subject and attachment names are also very interesting keywords

Do consider that data need to be normalized as the data:

can be split in multiple lines
can be encoded following RFC2047 ( From: =?US-ASCII?Q?Keith_Moore?= <moore@cs.utk.edu> , Subject: =?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?= )