[Bro] Performing file analysis with bro

[Tony Waller]

Hello,


I am trying to write a bro event that matches this example content conditions:


Payload string 1: content: "eaio" - This is example hex string

Payload string 2: content: ".exe HTTP"

When I look at file analysis it talk about the framework but leaves me to believe that it will only look at hash information. Any suggestions?

Sincerely,

Tony


Tony Waller, CISSP
Director, Systems Engineering
Bivio Networks, Inc.
“Powering Advanced Cyber Operations” (TM)
Mobile (443) 994-0936

[cid:9D7F8072-7FA8-45B5-AC0F-E8D71AFDE3BB]

*Note: The information contained in this email confidential. This information is intended only for the individual, individuals or entity to whom it is addressed. If you are not the intended recipient(s), the employee or agent responsible for delivering it to the intended recipient(s), you are hereby notified that any use, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this email in error, please return the original message to us by email and delete or destroy any copies. Please note any views or opinions expressed or presented in this email are solely those of the author and do not necessarily represent those of Bivio Networks, Inc. The recipient should check this email or any attachments for the presence of viruses or malware. Bivio Networks, Inc. accepts no responsibility for any damage caused by any virus or malware transmitted by this email. Thank you.

Think Green when printing

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160401/7bea071a/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CB97AD91-2E15-43EE-A2B4-B3542935CCB5[8].png
Type: image/png
Size: 8127 bytes
Desc: CB97AD91-2E15-43EE-A2B4-B3542935CCB5[8].png
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160401/7bea071a/attachment-0001.bin