Actions
Bug #2056
closedmissing warning on a rule using within with one content keyword
Affected Versions:
Effort:
Difficulty:
Label:
Description
alert udp $HOME_NET 1024: -> $EXTERNAL_NET 6000: (msg:"ET TROJAN Zeus P2P CnC"; content:"|AAAAAAAAAAAAAA|"; within:63; reference:url,www.abuse.ch/?p=3499; classtype:trojan-activity; sid:112233; rev:13;)
The rule above does not err/warn while loading in Suri but it should since within needs "two contents".
Tested with - 4.0dev (rev 6585ac4)
Updated by Victor Julien over 7 years ago
At least in some cases this is intentional, like with file_data. It's interpreted as 'depth'. IIRC this was to ensure compatibility with rules for Snort.
Updated by Andreas Herz over 7 years ago
- Assignee set to OISF Dev
- Target version set to TBD
Updated by Andreas Herz over 5 years ago
would be a warning still a valid solution?
Actions