Hello, I’m trying to rewrite an ET Rule as a local rule to exclude content and I’ll comment out the original ET SID.
I have made an attempt at this and would like to confirm this is the right syntax to do this. Will this work as written or would I need to include a “distance” modifier?
Original rule:
`alert smb any any -> $HOME_NET 445 (msg:”ET POLICY Possible Powershell .ps1 Script Use Over SMB”; flow:established,to_server; content:”SMB”; depth:8; content:”|00|.|00|p|00|s|00|1|00|”; nocase; distance:0; classtype:bad-unknown; sid:2027204; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_16, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2019_04_16;)`
In modified rule below I would like to exclude two .ps1 files named “test” and “test2″.
modified rule:
alert smb any any -> $HOME_NET 445 (msg:”ET POLICY Possible Powershell .ps1 Script Use Over SMB”; flow:established,to_server; content:”SMB”; depth:8; content:”|00|.|00|p|00|s|00|1|00|”; nocase; distance:0; `content:!”test”; nocase; content:!”test2″; nocase;`
classtype:bad-unknown; sid:2027204; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_16, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2019_04_16;)