[Bro] About bro signature reg exp

Marchisio Claudio cys5322 at gmail.com
Wed Aug 1 01:41:10 PDT 2018


I’m studying about bro-script and bro-signature

In my signature file

-------------------------------------------------
signature protosig_malware {
    ip-proto == tcp
    payload /(?m)^Cache?m/
    tcp-state originator, responder 
    eval ProtoSig::match
}
-------------------------------------------------

But signature payload not support pcre ( I know that bro using flex-reg exp)
So I want to use multiline search in bro-signature like pcre 
How to available this?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180801/f5ebeea5/attachment.html 


More information about the Bro mailing list