Hi ,
Signature will have to be dependent upon some flag. When the value of flag is
set then only the signature will get activated.
The value of flag will have to be set by some decoding signature. Decoding
signature will parse the SMTP traffic and set the value of flag. It will be at
high priority as compared to the other signatures. I have written the psuedo
code of decoding algo which sets the value of flag a.
So to the FP free signature for Mail From command to prevent FP,will check the
value of flag. If value of flag a = 1, then only signature should get
activated..
If (pattern="HELO" or EHLO or LHLO)
STEP 1 {
Varible a = 1; # HELO, EHLO LHLO are the first commands in SMTP # Connection
}
If (pattern="DATA\r\n" or pattern=DATA\n GOTO STEP 2 else STEP 1)
STEP 2 {
Variable a = 2;
}
If (pattern="\n\r\n" or pattern=\n\n GOTO STEP 3 or STEP 2)
STEP 3{
Variable a = 3;
}
If (pattern="\n\x2E\n" or pattern =\n\x2E\r\n GOTO STEP 4 else STEP 3)
STEP 4 {
Variable a = 1;
}
If (pattern="RSET")
STEP 1 {
Variable a = 1; # This operation will clear the variable.
}
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
