IPS Custom Signature - .torrent - Possible?

[kristianaasen]

Hi I was wondering if it is possible to create a custom signature that would produce an alert whenever someone clicks on a .torrent link..

I am using Build Version: 5.1(3)S247.0

Just started using the IPS so any help or pointers will be greatly appreciated

[mhellman]

Yes, should be possible. You can inspect the URL or you can inspect the HTTP headers (the latter will probably trigger less false positives).

Take a look at sig 3204-0 for a pretty simple example of URL inspection.

Take a look at sig 5800-0 for an example that inspects HTTP headers. I'm not a big torrent user, but I think you will be looking for

"Content-Type: application/x-bittorrent"

[wsulym]

You could do the following:

Using engine == Service-HTTP

URI regex == [.][Tt][Oo][Rr][Rr][Ee][Nn][Tt]

service ports == #WEBPORTS

that will fire any time ".torrent" is seen in the uri. So anytime someone clicks on a link the contains ".torrent" (case insensitive), the alert would fire.

[mhellman]

being nitpicky, but you didn't escape the dot. won't that pretty much trigger on the word "torrent" anywhere in the URL?

[kristianaasen]

THX for your help

[wsulym]

Within a character class you don't need to escape the dot.

[mhellman]

you're absolutely right, I forgot about that;-)

[kristianaasen]

THX for your help

[Shannon Sutter]

I've had no luck with this.

I've been trying to customized a signature to alert me when someone is browsing www.dropbox.com and can't get it to work.

I have configured the following:

Using engine == Service-HTTP

URI regex == [.][Dd][Rr][Oo][Pp][Bb][Oo][Xx]

service ports == #WEBPORTS

The status is enabled and the Event action is Produce Alert.

Am I missing something? I am not getting any alerts.

[rupadras]

Hi,

I replied in the other thread. Please try with header-regex instead of uri-regex, because the host name will appear in the HTTP header in the traffic.

Also, we have sig 38686 detecting dropbox usage. Perhaps those are what you are looking for.