Custom Sigs for APT Detection

[damonrouse]

Hi

I'm totally new to writing any kind of custom signature, but was wondering if anyone has written any for APT detection?  Specifically I'm looking at creating sigs for certain TCP packet info containing HTML and mime type info.  Please let me know if this is possible.

Thanks

Damon

[damonrouse]

FYI...I opened a TAC case just now.

[nearchib]

Hi Damon,

What you described definitly sounds possible.

You will need to be more specific though if you want help with that issue.

Regards

Neil Archibald

IPS Signature Team