diff --git a/rules/files.rules b/rules/files.rules index a54556f160..0e57329224 100644 --- a/rules/files.rules +++ b/rules/files.rules @@ -36,7 +36,7 @@ #alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (1)"; filemagic:"PNG image data, 1 x 1,"; sid:19; rev:1;) #alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (2)"; filemagic:"PNG image data, 1 x 1|00|"; sid:20; rev:1;) -# Alert on GIT with 1x1 pixels (tracking) +# Alert on GIF with 1x1 pixels (tracking) # The pattern matches on |00| which is the end of the magic buffer, this way we won't match on 1 x 128. #alert http any any -> any any (msg:"FILE tracking GIF (1x1 pixel)"; filemagic:"GIF image data, version 89a, 1 x 1|00|"; sid:21; rev:1;)