mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
caa7946888
Evasion scenario is - a first dummy write of one byte at offset 0 is done - the second full write of EICAR at offset 0 is then done and does not trigger detection The last write had the final value, and as we cannot "cancel" the previous write, we set an event which is then transformed into an app-layer decoder alert |
4 years ago | |
|---|---|---|
| .. | ||
| Makefile.am | ||
| app-layer-events.rules | ||
| decoder-events.rules | ||
| dhcp-events.rules | ||
| dnp3-events.rules | ||
| dns-events.rules | ||
| files.rules | ||
| http-events.rules | ||
| http2-events.rules | ||
| ipsec-events.rules | ||
| kerberos-events.rules | ||
| modbus-events.rules | ||
| mqtt-events.rules | ||
| nfs-events.rules | ||
| ntp-events.rules | ||
| smb-events.rules | 4 years ago | |
| smtp-events.rules | ||
| ssh-events.rules | ||
| stream-events.rules | ||
| tls-events.rules | ||