PCRE keyword modifiers

For Network IPS appliances, use Perl compatible regular expressions (PCRE) keywords to write rules for OpenSignatures.

Syntax

pcre:[!]"""(/<regex>/|m<delim><regex><delim>) [ismxAEGRUB]""";

Examples

alert tcp any any -> any any (pcre:"""/GOO/i""";)

alert tcp any any -> any any (pcre:"""/GET.*\.htm/i""";)

alert tcp any any -> any 80 (msg:"""Google image

search""";pcre:"""/Host\:\simages.google.com\r\n/ism""";sid:1000;)

Examples of mixed content and PCRE

alert tcp any any -> any 80 (msg:"""Gator Agent Traffic""";content:!"""User-Agent\:Akregator""";pcre:"""/User-Agent\:[^\n]+Gator/i""";sid:1000;)

alert tcp any any -> any 80 (msg:"""Yahoo Mail Login""";content:"""yahoo""";pcre:"""/(Host\:)\s[a-zA-Z0-9.-]+(\.mail.yahoo.com\r\n) /ism""";sid:1000;)