Forum Discussion
Mike_Maher
Nimbostratus
NimbostratusAttack Signature question
Can someone take a look at the Attack Signature below and let me know if it looks ok. I don't have much experience writing them and want to make sure I am not making some sort of big mistake.
...
nathe
Cirrocumulus
CirrocumulusMike,
I think you need to pop a ; after the content too e.g. content: "/proc/self/fd/3"; nocase;
Also, do you need to escape the special characters in the headercontent? You would use the pipe | to do this. I can't be 100% on this.
N