Creating signatures in CSM

[jhall0007]

All,

I am trying teach myself how to write simple signatures and was wondering if anyone could give me some advice. Specifically, I am trying to create a signature that will hit on any DNS queries asking for anything other than a few dot extensions (i.e. anything other than .edu, gov, etc). I am looking at different regular expressions but struggling finding the correct logic of multiple negations. Has anyone tried to do something similar, any advice?

Thanks,

[androdri]

Hello,

There is a guide that might be of some help to you for writing custom signatures it can be found at:

http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html

If you continue to have questions you can email ipssig-customer-request to get some guidance on writing your custom signature.  Include a complete description of what you are trying to fire on and not fire on,  a good traffic sample.   Please note the signature you are trying to write will probably fire a lot and may cause performance degradations or may false positive.