Forum Discussion
jamesdris
Nimbostratus
Nimbostratusmatch regex in payload
iam trying to write a rule to search for a regex for any URL in HTTP::payload, this is what i am using:
when HTTP_REQUEST_DATA {
if { [HTTP::payload] matches_regex {[(https?|ftp):\/\/..]} }
{
HT...
pete_71470
Cirrostratus
CirrostratusThe [] pair in a regex matches any single character inside the brackets. So in your example a match is found if the payload contains (, h, t, p, s, etc. Try omitting the square brackets:
[HTTP::payload] matches_regex { (https?|ftp):\/\/.. }
