[Bro] ZWS File Magic Inclusion

[Seth Hall]

> On Mar 18, 2015, at 1:59 PM, Jason Batchelor <jxbatchelor at gmail.com> wrote:
> 
> Then ran bro along side my extraction script on the PCAP and out the LZMA compressed SWF came. Just wanted to pass this along. It might be worth adding it to the sig files for a future release possibly?

That was added a while ago and is queued up for inclusion into 2.4...

signature file-swf {
	file-magic /^(F|C|Z)WS/
	file-mime "application/x-shockwave-flash", 60
}

2.4 has a ton of updates to file type identification and it looks like there are going to be some more updates before the release too.

   .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/