42 Commits (d2fdbc7d6f7e253c3a892e30dfba7af0cf6ac4d9)

Author	SHA1	Message	Date
Pierre Chifflier	9dfec7e734	SNMP: add the "snmp.pdu_type" detection keyword	6 years ago
Pierre Chifflier	e1dd19a0eb	SNMP: add the "snmp.community" detection keyword	6 years ago
Pierre Chifflier	aa608e0ca2	SNMP: add the "snmp.version" detection keyword	6 years ago
Mats Klepsland	0b489f329c	detect: add (mpm) keyword ja3s.string ... Match on JA3S string using ja3s.string keyword, e.g: alert tls any any -> any any (msg:"ja3s.string test"; ja3s.string; content:"10-11-12"; sid:1;)	6 years ago
Mats Klepsland	80cee50916	detect: add (mpm) keyword ja3s.hash ... Match on JA3S hash using ja3s.hash keyword, e.g: alert tls any any -> any any (msg:"ja3s.hash test"; ja3s.hash; content:"b26c652e0a402a24b5ca2a660e84f9d5"; sid:1;)	6 years ago
Mats Klepsland	ba857e9739	detect: add tls.certs keyword ... Add keyword to do "raw" matching on each of the certificates in the TLS certificate sticky buffer. Example: alert tls any any -> any any (msg:"tls.certs test"; tls.certs; \ content:"|01 02 03 04|"; sid:1;)	6 years ago
Victor Julien	84881bf1b8	detect/file.magic: add sticky buffer ... Add sticky buffer to inspect file magic. Includes mpm support.	6 years ago
Jeff Lucovsky	81c1af0887	detect: implement http {location,server} sticky buffer ... This implements inspection of the Server and Location buffer as a content sticky buffer.	6 years ago
Victor Julien	7497c633c4	detect/filestore: use postmatch callback	6 years ago
Victor Julien	e710b06669	detect: add file.name sticky buffer	7 years ago
Victor Julien	ca8471387a	detect: add http.response_body sticky buffer ... As a mirror of the http_server_body content modifier.	7 years ago
Victor Julien	2221dd9403	detect: add http.request_body sticky buffer ... Sticky buffer version of the http_client_body content modifier.	7 years ago
Victor Julien	645acb1089	detect: add http.header.raw sticky buffer keyword ... Add parsing tests as well.	7 years ago
Victor Julien	85697671b8	detect: add http.header sticky buffer keyword	7 years ago
Victor Julien	dac182741b	detect: add http.cookie sticky buffer keyword	7 years ago
Victor Julien	b8a0a0d6ea	detect: add http.stat_code sticky buffer keyword	7 years ago
Victor Julien	59c3c748c9	detect: add http.stat_msg sticky buffer keyword	7 years ago
Victor Julien	e9d43254c8	detect: add http.host.raw sticky buffer	7 years ago
Victor Julien	e9fcb9d5ef	detect/http_method: add http.method sticky buffer	7 years ago
Victor Julien	4e50df0f55	detect/http: add http.uri.raw sticky buffer keyword	7 years ago
Victor Julien	0c879d5041	detect: add http.uri sticky buffer keyword	7 years ago
Victor Julien	789f302d1a	detect: add http.host sticky buffer	7 years ago
Victor Julien	123ebb2c41	detect: add http.user_agent sticky buffer	7 years ago
Victor Julien	eb73008ccf	detect/transform: add to_sha1 keyword	7 years ago
Victor Julien	75f9c1ae9f	detect/transform: add to_md5 keyword	7 years ago
Jason Ish	35fd10bc2e	rust: app-layer detect template for rust parsers	7 years ago
Victor Julien	486054595a	detect/template2: template with prefilter (copy of ttl)	7 years ago
Victor Julien	085521b218	detect: include keyword types in detect.h	7 years ago
Pierre Chifflier	1076c7cd47	Add krb5_err_code detection keyword	7 years ago
Pierre Chifflier	d6b9c0294a	Add krb5_cname and krb5_sname detection keywords	7 years ago
Pierre Chifflier	0bd81ff838	Add krb5_msg_type detection keyword	7 years ago
Mats Klepsland	6e23ae230b	detect: add (mpm) keyword ja3_string ... Match on JA3 string using ja3_string keyword, e.g: alert tls any any -> any any (msg:"JA3 string test"; ja3_string; content:"65-68-69-102"; sid:1;)	7 years ago
Mats Klepsland	6c7aacce9e	detect: add (mpm) keyword ja3_hash ... Match on JA3 hash using ja3_hash keyword, e.g: alert tls any any -> any any (msg:"JA3 hash test"; ja3_hash; content:"e7eca2baf4458d095b7f45da28c16c34"; sid:1;)	7 years ago
Victor Julien	75d7c9d64a	rust/smb: initial support ... Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5)	7 years ago
Victor Julien	4d1fa4aaf9	detect: bsize keyword ... Allows matching on stickybuffers. Like dsize, it allows matching on exact values, greater than and less than, and ranges. For streaming buffers, such as HTTP bodies, the final size of the body is only known at the end of the transaction.	8 years ago
Victor Julien	7f97fc40d5	detect/transform: initial to_sha256 implementation ... Takes input buffer and replaces it with hash value for that buffer. Hash value is in raw bytes.	8 years ago
Victor Julien	016d65fdf8	detect/transform: initial compress_whitespace implementation	8 years ago
Victor Julien	38ed6cd050	detect/transform: initial strip_whitespace implementation	8 years ago
Victor Julien	d588237235	detect/content: implement endswith	8 years ago
Victor Julien	07738af868	detect/content: introduce startswith modifier ... Add startswith modifier to simplify matching patterns at the start of a buffer. Instead of: content:"abc"; depth:3; This enables: content:"abc"; startswith; Especially with longer patterns this makes the intention of the rule more clear and eases writing the rules. Internally it's simply a shorthand for 'depth:<pattern len>;'. Ticket https://redmine.openinfosecfoundation.org/issues/742	8 years ago
Eric Leblond	cbce2c78bd	detect-ftpdata: match on ftp-data operation ... This keyword mathes on ftp operation STOR and RETR. It will allow rules writer to select if the alert has to be on a put or a fetch operation. It is now possible to write a signature like: alert ftp-data any any -> any any (msg:"FTP data get firwmare"; ftdata_command:retr; sid:2; rev:1;) to alert when a file is retrieved from a FTP server.	8 years ago
Victor Julien	c374324916	detect: move keyword registration into own file	8 years ago