Re: SMTP traffic

[max () hotmail com]

Hi ,

 Signature will have to be dependent upon some flag. When the value of flag is set then only the signature will get 
activated. 

The value of flag will have to be set by some decoding signature. Decoding signature will parse the SMTP traffic and 
set the value of flag. It will be at high priority as compared to the  other signatures. I have written the psuedo code 
of decoding algo which sets the value of flag a.

 So to the FP free signature for Mail From command to prevent FP,will check the value of flag. If value of flag a = 1, 
then only signature should get activated..





If (pattern="HELO" or “EHLO” or “LHLO”)
  
  STEP 1 {
Varible a = 1;   # HELO, EHLO LHLO are the first commands in SMTP  # Connection
         }

    If (pattern="DATA\r\n" or pattern=”DATA\n” GOTO STEP 2 else STEP 1)
 
  STEP 2 {
             
              Variable a = 2; 
         }

    If (pattern="\n\r\n" or pattern=”\n\n” GOTO STEP 3 or STEP 2)
  
  STEP 3{
          Variable a = 3;
        }
 If (pattern="\n\x2E\n" or pattern =”\n\x2E\r\n” GOTO STEP 4 else STEP 3)
STEP 4 {
          Variable a = 1; 
         }

 If (pattern="RSET")
   STEP 1 {
          Variable a = 1; # This operation will clear the variable. 
      }




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------