- Login: zoomequipd
- Registered on: 09/17/2019
- Last connection: 08/04/2022
- 06:30 PM Suricata Bug #5541 (New): Unexpected behavior of `endswith` in combination with negated content matches
- Please consider the following rule and attached pcaps.
The intention of the rule is to alert when the http.host b...
- 05:26 PM Suricata Bug #5439 (New): Invalid certificate when Issuer is not present.
- When investigating the Sliver Framework, it was observed that certificates which lack an Issuer (or contain an issuer...
- 04:24 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars
- Updated pcap as Shivani pointed out the 97b97bef320a2ea.pcap was missing the hose host header and resulted in anomaly...
- 08:51 PM Suricata Bug #5208: DCERPC protocol detection when nested in SMB
- > So I guess the question is if the dcerpc app protocol specification in the rule should be overloaded to mean "eithe...
- 02:38 AM Suricata Bug #5197: fast_pattern assignment of specific content results in FN
- I just tested again, just to make sure and was able to replicate only sid:1 alerting.
Attached are the config, and ...
- 01:32 PM Suricata Feature #5245 (New): allow fast_pattern on base64_data strings
- As referenced within issue 5220 - the engine today does not use nor error out when a fast_pattern is provided on a co...
- 04:39 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars
- the following rule, when run on snort 2.9.18 (only tested version) works as expected. this is equivalent to sid:1; of...
- 04:11 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars
> Pay particular attention to sid:4 and sid:2 where the only difference is how far into the base64 enc...
- 04:09 PM Suricata Bug #5223 (In Progress): base64_decode does not populate base64_data buffer once hitting non-base64 chars
- consider the following rules and the attached pcap.
The rules are designed to test the behavior of when non-base6...
- 07:29 PM Suricata Feature #5075: smb: keyword for the SMB version
- any support for SMB3?
Also available in: Atom