RE: [Snort-users] Dectecting Social Security Numbers?

It will catch some cookies too, but works pretty good over all. I am
not the best at rule writing :) =20
There is a way to make it only trigger if there is a blank space in
front and back but I have not had the time to look it up. If anyone
know how to do this off the top of there head let me know. Although
this is really a snort-sigs question. (I hope there is a penalty drink
in that for me seeing as it is Friday. I guess I could answer my own
post and reply in HTML and that would start the evening off right :) )


=20
-----Original Message-----
From: Lyons, Jon [mailto:Jon_Lyons@enh.org]=20
Sent: Friday, September 10, 2004 3:15 PM
To: Harper, Patrick; snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] Dectecting Social Security Numbers?

Thanks, I've tried multiple rules, but this one works the best...

Thanks!

-----Original Message-----
From: Harper, Patrick [mailto:patrick.harper@phns.com]
Sent: Friday, September 10, 2004 3:10 PM
To: Lyons, Jon; snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] Dectecting Social Security Numbers?

I use:

alert ip $HOME_NET any -> $EXTERNAL_NET any
(pcre:"/[1-9]{3,3}[-][1-9]{2,2}[-][1-9]{4,4}/"; msg:"SSN# in clear
text"; classtype:policy-violation; sid:2000370; rev:2;) =20


Works for me
=20
-----Original Message-----
From: Lyons, Jon [mailto:Jon_Lyons@enh.org]
Sent: Friday, September 10, 2004 1:02 PM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Dectecting Social Security Numbers?

=20
I'm trying to get snort to generate an alert for SS#'s, I've tried the
rule below but no alerts are generated. I tested this with pcretest and
it works...am I missing something?
alert tcp any any -> any any (msg:"Socail Security Number Clear Text";
pcre:"m!(\d\d\d[-/]\d\d[-/]\d\d\d\d)\Z!";)




Disclaimer:
This electronic message, including any attachments, is confidential and
intended solely for use of the intended recipient(s). This message may
contain information that is privileged or otherwise protected from
disclosure by applicable law. Any unauthorized disclosure,
dissemination, use or reproduction is strictly prohibited. If you have
received this message in error, please delete it and notify the sender
immediately.=20









Disclaimer:
This electronic message, including any attachments, is confidential and int=
ended solely for use of the intended recipient(s). This message may contain=
information that is privileged or otherwise protected from disclosure by a=
pplicable law. Any unauthorized disclosure, dissemination, use or reproduct=
ion is strictly prohibited. If you have received this message in error, ple=
ase delete it and notify the sender immediately.=20





-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users