Project

General

Profile

Actions

Feature #7322

closed

ability to negate the existence of fields via buffer negation

Added by James Emery-Callcott 3 months ago. Updated about 1 month ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

While writing hunting signatures today, we noticed that it is not possible to negate the existence of a buffer which we think would be valuable in several signature ideas.

For example - if we want to write a signature that looks for a HTTP POST request that contains a Content-Length header with a valid value but the traffic indicates that nothing is sent, http.request_body; is empty but there is no way to negate that or detect that the buffer is not present. We tried using isdataat, bsize:0;, and pcre:"/^$/"; which all fail (presumably because there is just no buffer there in the first place).


Related issues 1 (0 open1 closed)

Is duplicate of Suricata - Bug #2224: Negated http_* match returns false if buffer not populatedClosedPhilippe AntoineActions
Actions

Also available in: Atom PDF