I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule
content:"|37 e1 a4|"; I can add the full rule if that can help.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community