Sig for NT account

[bizsnatch]

I want to create a signature that will fire on an admin account logging in to NT 4.

account: admin

Any suggestions?

It needs to use the SMB protocol

[bizsnatch]

I tried creating a string.tcp sig and using the regex:

[A][a][D][d][M][m][I][i][N][n]

I also tried the hex representation of admin:

[61][00][64][[00]][6d][00][69][00][6e][00][00][00]

Neither worked

[jimwelsh]

First, you need to better understand Regular Expression Syntax. This document should help:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/cmdref/15599ch1.htm

Specifically, chars inside square brackets means "any one of these chars". So "[A][a][D][d]" means exactly "AaDd", and "[61][00][64]" means "606" or "604" or "106" or "104".

Try this:

[Aa]\x00[Dd]\x00[Mm]\x00[Ii]\x00[Nn]\x00\x00\x00

It will match "admin" with any combination of upper- or lower-case chars, and has the necessary null chars ("\x00") inserted, including the two nulls at the end that mark the end of the string.

[scothrel]

It will also likely be Unicode encoded if its sourced from an NT box.

[jimwelsh]

Re: Unicode: Exactly. Hence, the \x00 chars.