I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even after modifying some parameters. Can someone point me to a site or an example of the snort detection rule for detecting slowloris attacks.
slowloris don't finish web request header.
pcre:!"/\x0D\x0A\x0D\x0A$/H"; will detect web request not ending with
Or you can also use
/D that Match unnormalized HTTP request or HTTP response header.
But i'm not sure this would work.:) In fact, i think it is better to monitor changes in session volume than pattern matching, if you want to detect like slowloris.