Skip to content

R
rules
Unverified Commit 11c76bf5 by Jaume Martin Committed by GitHub
Options

Merge pull request #374 from unamuno/patch-1 

Add ipv6 support
parents 2bb79cb6 e121fffc
Showing with 3 additions and 2 deletions
utils/ip.yar
...@@ -7,7 +7,8 @@ rule IP { ...@@ -7,7 +7,8 @@ rule IP {
meta: meta:
author = "Antonio S. <asanchez@plutec.net>" author = "Antonio S. <asanchez@plutec.net>"
strings: strings:
$ip = /([0-9]{1,3}\.){3}[0-9]{1,3}/ wide ascii $ipv4 = /([0-9]{1,3}\.){3}[0-9]{1,3}/ wide ascii
$ipv6 = /(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/ wide ascii
condition: condition:
$ip any of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment