[Bro] ZWS File Magic Inclusion

Seth Hall seth at icir.org
Wed Mar 18 11:12:38 PDT 2015

> On Mar 18, 2015, at 1:59 PM, Jason Batchelor <jxbatchelor at gmail.com> wrote:
> Then ran bro along side my extraction script on the PCAP and out the LZMA compressed SWF came. Just wanted to pass this along. It might be worth adding it to the sig files for a future release possibly?

That was added a while ago and is queued up for inclusion into 2.4...

signature file-swf {
	file-magic /^(F|C|Z)WS/
	file-mime "application/x-shockwave-flash", 60

2.4 has a ton of updates to file type identification and it looks like there are going to be some more updates before the release too.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list