topic Re: Regex string for SMTP command in Network Security

Regex string for SMTP command

rrutledge — Sun, 10 Mar 2019 10:26:56 GMT

Hi Everyone,

I would like to create a signature to look for SMTP "command mail from:<>". Is this the right regex statement to look for this traffic?

[Mm][Aa][Ii][Ll] [Ff][Rr][Oo][Mm][:][<>]

Re: Regex string for SMTP command

wsulym — Wed, 31 Jan 2007 19:49:21 GMT

I usually use the hex equivalent of the space, but that's just personal preference as it makes it easier to read to me (and i don't inadvertently add random spaces where I don't want them).

[Mm][Aa][Ii][Ll]\x20[Ff][Rr][Oo][Mm][:][<>]

Realize that [<>] is a character class and means "<" or ">" in that spot, so the regex you propose would match:

mail from:<

mail from:>

If you wanted to find:

mail from:<> (no value in between the braces) then the following:

[Mm][Aa][Ii][Ll]\x20[Ff][Rr][Oo][Mm][:][<][>]

Re: Regex string for SMTP command

rrutledge — Wed, 31 Jan 2007 19:53:35 GMT

Thanks

Re: Regex string for SMTP command

mhellman — Wed, 31 Jan 2007 19:57:28 GMT

Do you mean you're looking for the SMTP "mail from:" command following by empty brackets? That's close but not quite right.

[Mm][Aa][Ii][Ll][ \t]*[Ff][Rr][Oo][Mm][:][ \t]*[<][>]

I believe different mail servers allow different behavior, so you might be able to get rid of the "[ \t]*" sections if you know how your mail server behaves.

Re: Regex string for SMTP command

rrutledge — Wed, 31 Jan 2007 20:00:33 GMT

Already got serveral hits