Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am new to snort rules and need a rule that will alert any email from a specific user.. For example:

alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; fast_pattern:only; nocase; classtype: Target Email Detected ;sid:12345 ;)

This rule as of now will sniff it if it is in the content, but mail from the email above is not alerted.

share|improve this question
add comment

1 Answer 1

Your rule looks good for the most part. I believe the problem has to do with your sid mapping / classtype. If you define a new classtype as you have done there are additional configuration options that need to be set - in this case it is much easier to recycle something existing. I would suggest using a classtype of policy-violation.

RE: Comment The content field searches the entire body of the packet it sees. It shouldn't be a PCRE issue. You might want to look at assembling the stream. It might be that the string you are searching for is being broken between packets. Try firing up Wireshark and capturing the exact packets you want.

share|improve this answer
    
I created the custom classtype and it works ok, I feel its something with it not capturing mail headers right or something, would a pcre be needed? –  ThatGuy Oct 18 '11 at 15:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.