This is a discussion on I don't understand byte_jump with from_beginning within the Snort forums, part of the System Security and Security Related category; Hi I look at rules NETBIOS SMB-DS umpnpmgr PNP_QueryResConfList unicode little endian attempt (sid=3999) alert tcp $EXTERNAL_NET any -&...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
Hi I look at rules NETBIOS SMB-DS umpnpmgr PNP_QueryResConfList unicode little endian attempt (sid=3999) alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS umpnpmgr PNP_QueryResConfList unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.bind.umpnpmgr; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/sR"; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/sR"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"6|00|"; within:2; distance:19; reference:url,http://www.microsoft.com/technet/sec...ms05-039.mspx; classtype:protocol-command-decode; sid:3999; rev:1;) why after rule option “byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/sR"”, the doe_ptr at 0x58。 I don’t understand “byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/sR"” how to work? |