Open Information Security Foundation

09/14/2022

06:30 PM Suricata Bug #5541 (New): Unexpected behavior of `endswith` in combination with negated content matches

Please consider the following rule and attached pcaps.
The intention of the rule is to alert when the http.host b... Brandon Murphy

07/07/2022

05:26 PM Suricata Bug #5439 (New): Invalid certificate when Issuer is not present.

When investigating the Sliver Framework, it was observed that certificates which lack an Issuer (or contain an issuer... Brandon Murphy

06/15/2022

04:24 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars

Updated pcap as Shivani pointed out the 97b97bef320a2ea.pcap was missing the hose host header and resulted in anomaly... Brandon Murphy

06/10/2022

08:51 PM Suricata Bug #5208: DCERPC protocol detection when nested in SMB

> So I guess the question is if the dcerpc app protocol specification in the rule should be overloaded to mean "eithe... Brandon Murphy

04/10/2022

02:38 AM Suricata Bug #5197: fast_pattern assignment of specific content results in FN

I just tested again, just to make sure and was able to replicate only sid:1 alerting.
Attached are the config, and ... Brandon Murphy

04/08/2022

01:32 PM Suricata Feature #5245 (New): allow fast_pattern on base64_data strings

As referenced within issue 5220 - the engine today does not use nor error out when a fast_pattern is provided on a co... Brandon Murphy

03/30/2022

04:39 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars

the following rule, when run on snort 2.9.18 (only tested version) works as expected. this is equivalent to sid:1; of... Brandon Murphy

04:11 PM Suricata Bug #5223: base64_decode does not populate base64_data buffer once hitting non-base64 chars

correction:
> Pay particular attention to sid:4 and sid:2 where the only difference is how far into the base64 enc... Brandon Murphy

04:09 PM Suricata Bug #5223 (In Progress): base64_decode does not populate base64_data buffer once hitting non-base64 chars

consider the following rules and the attached pcap.
The rules are designed to test the behavior of when non-base6... Brandon Murphy

03/25/2022

07:29 PM Suricata Feature #5075: smb: keyword for the SMB version

any support for SMB3?
https://docs.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview Brandon Murphy