Content keyword modifiers for OpenSignatures

For Network IPS appliances, use the keyword content to set rules that search for specific content in the packet payload.

Important: OpenSignatures require the content keyword to function properly. If the OpenSignature rule is improperly formatted, you might receive a PAM configuration error response.

When the content is detected, the event responds based on the data provided.

The option data for the content keyword can contain both text and binary data. The binary data is enclosed within the pipe ( | ) character and represented as bytecode. Bytecode represents binary data as hexadecimal numbers and is a good shorthand method for describing complex binary data.

Example 1: alert tcp any any -> any any (msg:"""Access google"""; content:"""google"""; nocase; sid:1000;)
Example 2: alert tcp any any -> any any (msg:"""Search google in binary form"""; content:"""|77 2E 67 6f 6F 67 6c 65|""";nocase;sid:1000;)