|
|
|
|
@ -1,6 +1,8 @@
|
|
|
|
|
FTP/FTP-DATA Keywords
|
|
|
|
|
=====================
|
|
|
|
|
|
|
|
|
|
.. role:: example-rule-options
|
|
|
|
|
|
|
|
|
|
ftpdata_command
|
|
|
|
|
---------------
|
|
|
|
|
|
|
|
|
|
@ -12,14 +14,13 @@ Syntax::
|
|
|
|
|
|
|
|
|
|
ftpdata_command:(retr|stor)
|
|
|
|
|
|
|
|
|
|
Examples::
|
|
|
|
|
|
|
|
|
|
ftpdata_command:retr
|
|
|
|
|
ftpdata_command:stor
|
|
|
|
|
Signature Example:
|
|
|
|
|
|
|
|
|
|
Signature example::
|
|
|
|
|
.. container:: example-rule
|
|
|
|
|
|
|
|
|
|
alert ftp-data any any -> any any (msg:"FTP store password"; filestore; filename:"password"; ftpdata_command:stor; sid:3; rev:1;)
|
|
|
|
|
alert ftp-data any any -> any any (msg:"FTP store password"; \
|
|
|
|
|
filestore; filename:"password"; \
|
|
|
|
|
:example-rule-options:`ftpdata_command:stor;` sid:3; rev:1;)
|
|
|
|
|
|
|
|
|
|
ftpbounce
|
|
|
|
|
---------
|
|
|
|
|
@ -35,9 +36,12 @@ file.name
|
|
|
|
|
|
|
|
|
|
The ``file.name`` keyword can be used at the FTP application level.
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
Signature Example:
|
|
|
|
|
|
|
|
|
|
.. container:: example-rule
|
|
|
|
|
|
|
|
|
|
alert ftp-data any any -> any any (msg:"ftp layer file.name keyword usage"; \
|
|
|
|
|
file.name; content:"file.txt"; classtype:bad-unknown; sid:1; rev:1;)
|
|
|
|
|
alert ftp-data any any -> any any (msg:"FTP file.name usage"; \
|
|
|
|
|
:example-rule-options:`file.name; content:"file.txt";` \
|
|
|
|
|
classtype:bad-unknown; sid:1; rev:1;)
|
|
|
|
|
|
|
|
|
|
For additional information on the ``file.name`` keyword, see :doc:`file-keywords`.
|