1

I am trying to create a simple rule to alert when "MZ" are the first two characters in the HTTP body.

My current rule is:

alert tcp any any -> any any (msg:"Test"; content:"MZ"; depth: 2; http_client_body; sid:51; rev:1;)

But this finds no results despite "MZ" definitely being present in the HTTP body.

Assistance much appreciated.

Unencoded
  • 242
  • 3
  • 19

1 Answers1

5

After seeking assistance from a few other sources, it turns out I was asking snort to look in the wrong place:

The correct rule is below:

alert tcp any any -> any any (msg:"Test"; file_data; content:"MZ"; depth: 2; sid:51; rev:1;)

Instead of http_client_body after the content string, the rule needed file_data before the content string.

http_client_body = the request body

file_data = the response body*

(*It's more complicated than that, but this is sufficient to explain this case. Please see the Snort documentation for further reference)

Unencoded
  • 242
  • 3
  • 19