snort rule: logging access to site containing the word “Malware”
-
19-09-2019 - |
Question
I am trying to create a rule for snort to basically log any packets once a user tries to access a page with the word "malware" in it. This is what I have, just asking for some guide. So basically once a webpage contains the phrase it shows an alert.
alert tcp any any -> any any
(content:"malware";
msg:"Someone clone is accessing a page with malware tagged!!!!";
aid:10000002;rev:1;)
Solution
alert tcp any any -> any any (content:"malware"; msg:"Someone clone is accessing a page with malware tagged!!!!"; aid:10000002;rev:1;)
Actually worked and the problem was solved
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow