PCRE keyword modifiers

Use Perl compatible regular expressions (PCRE) keywords to write rules for OpenSignatures on your Network IPS appliance.

Syntax

pcre:[!]"(/<regex>/|m<delim><regex><delim>) [ismxAEGRUB]";

Examples

alert tcp any any -> any any (pcre:"/GOO/i";)

alert tcp any any -> any any (pcre:"/GET.*\.htm/i";)

alert tcp any any -> any 80 (msg:"Google image

search";pcre:"/Host\:\simages.google.com\r\n/ism";sid:1000;)

Examples of mixed content and PCRE

alert tcp any any -> any 80 (msg:"Gator Agent Traffic";content:!"User-Agent\:Akregator";pcre:"/User-Agent\:[^\n]+Gator/i";sid:1000;)

alert tcp any any -> any 80 (msg:"Yahoo Mail Login";content:"yahoo";pcre:"/(Host\:)\s[a-zA-Z0-9.-]+(\.mail.yahoo.com\r\n) /ism";sid:1000;)