mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
80 lines
2.0 KiB
ReStructuredText
80 lines
2.0 KiB
ReStructuredText
IMAP Keywords
|
|
=============
|
|
|
|
.. role:: example-rule-action
|
|
.. role:: example-rule-header
|
|
.. role:: example-rule-options
|
|
.. role:: example-rule-emphasis
|
|
|
|
imap.request
|
|
------------
|
|
|
|
Matches on IMAP request lines sent from the client to the server.
|
|
|
|
Each buffer is a request line as sent by the client, without the trailing
|
|
CRLF. Literal data is not part of the buffer. Unlike the EVE
|
|
``imap.requests`` field, ``LOGIN`` and ``AUTHENTICATE`` arguments are not
|
|
redacted.
|
|
|
|
Syntax::
|
|
|
|
imap.request; content:"<content to match against>";
|
|
|
|
``imap.request`` is a 'sticky buffer' and can be used as a ``fast_pattern``.
|
|
|
|
``imap.request`` supports multiple buffer matching, see :doc:`multi-buffer-matching`.
|
|
|
|
This keyword maps to the EVE field ``imap.requests[]``
|
|
|
|
Examples
|
|
^^^^^^^^
|
|
|
|
Example of a signature that would alert if an IMAP request contains a LOGIN command:
|
|
|
|
.. container:: example-rule
|
|
|
|
alert imap any any -> any any (msg:"IMAP LOGIN request"; :example-rule-emphasis:`imap.request; content:"LOGIN";` sid:1;)
|
|
|
|
imap.response
|
|
-------------
|
|
|
|
Matches on IMAP response lines sent from the server to the client.
|
|
|
|
Syntax::
|
|
|
|
imap.response; content:"<content to match against>";
|
|
|
|
``imap.response`` is a 'sticky buffer' and can be used as a ``fast_pattern``.
|
|
|
|
``imap.response`` supports multiple buffer matching, see :doc:`multi-buffer-matching`.
|
|
|
|
This keyword maps to the EVE field ``imap.responses[]``
|
|
|
|
Examples
|
|
^^^^^^^^
|
|
|
|
Example of a signature that would alert if an IMAP response contains "OK":
|
|
|
|
.. container:: example-rule
|
|
|
|
alert imap any any -> any any (msg:"IMAP OK response"; :example-rule-emphasis:`imap.response; content:"OK";` sid:1;)
|
|
|
|
Frames
|
|
------
|
|
|
|
The IMAP parser supports the following frames:
|
|
|
|
* imap.pdu
|
|
|
|
imap.pdu
|
|
^^^^^^^^
|
|
|
|
A single IMAP request or response PDU. Each command from the client or
|
|
response line from the server creates a separate frame.
|
|
|
|
.. container:: example-rule
|
|
|
|
alert imap any any -> any any (\
|
|
:example-rule-options:`frame:imap.pdu; content:"LOGIN"; startswith;` \
|
|
sid:1;)
|