Forum Discussion

Patti_G_72768's avatar
Patti_G_72768
Icon for Nimbostratus rankNimbostratus
Oct 31, 2013

Need help with iRule to detect LOIC/HOIC client

Hi all, the latest rule I'm working on is supposed to detect a LOIC/HOIC client. The rule is supposed to look for the following in the uri query string (not case sensitive): 1) "msg" 2) "id" 3) rando...
application delivery
devops
iRules
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 31, 2013

You also mentioned in another post that you were cutting over to ASM and writing these iRules to emulate signatures in your current product. I would venture two things then:

 

  1. While it may not be called "LOIC" in the ASM signature database, I'm certain that the effects of this exploit are detected.

     

  2. It might make more sense to create custom ASM signatures instead of individual iRules.

     

    http://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-3-0/asm_apx_attack_sig_syntax.html?sr=26601489