Let's take a look into different types and how to create custom Web Application Firewall Signatures
Single Part Signatures
The basic signature unit is part, which contains the actual signature text.
Example: The following signature searches for the text “hello world”.
part=”hello world”
Use \x<hex value> to add binary characters to the signature.
Example: In the following signature the white space is replaced with \x20.
part=”hello\x20world”
To look for the backslash character, enter a double backslash.
Example:The following signature looks for the text “hello\world”.
part=”hello\\world”
Note: The length of the text searched for by part must be at least three characters. Secure Sphere does not save signatures containing part lengths less than three characters.
Multi Part Signatures
You can include as many parts as required in a signature to search for a sequence of text strings.
Example: The following signature:
part=”Imperva”, part=”Secure”, part=”Sphere”
can match either of the following strings:
• abcdImpervaSecureSphere
• abcdImpervaabcdSecureSphere
• abcdImpervaabcdSecure---Sphere
Different parts should be separated by a comma. White spaces are allowed before and after the comma.
Absolute Modifiers
Absolute modifiers limit the part to be matched to a specific area of a stream.
The absolute modifiers that are supported are:
• amin: The absolute position in the stream to start matching this part.
• amax: The absolute position in the stream to stop matching this part.
Example: The following signature searches for the string cmd.exe only from position 10 to position 20 in the stream.
part=”cmd.exe”, amin=”10”, amax=”20”
You can include absolute modifiers after any part by using commas. You can either add a single modifier or both modifiers for each part.
Relative Modifiers
Relative modifiers limit the part to a specific area after the previous part.
The supported relative modifiers are:
• rmin: The position, relative to the previous part to start searching for this part.
• rmax: The position, relative to the previous part to stop searching for this part.
Example: The following signature includestwo parts. The second part is searched for in a range of 10
characters from the first part.
part=”cmd”, part=”.exe”, rmax=”10”
The string cmd12345.exe matches this signature. However the string cmd12345678.exe does not match the signature because the “.exe” part ends 12 characters after the “cmd” part. You can include relative modifiers after any part by using commas. You can either add a single modifier or both modifiers for each part. You can also include both relative and absolute modifiers for the same part.
Relative modifiers are ignored for the first part, as the part must be relative to the previous part, which in this case does not exist.
Single Part Signatures
The basic signature unit is part, which contains the actual signature text.
Example: The following signature searches for the text “hello world”.
part=”hello world”
Use \x<hex value> to add binary characters to the signature.
Example: In the following signature the white space is replaced with \x20.
part=”hello\x20world”
To look for the backslash character, enter a double backslash.
Example:The following signature looks for the text “hello\world”.
part=”hello\\world”
Note: The length of the text searched for by part must be at least three characters. Secure Sphere does not save signatures containing part lengths less than three characters.
Multi Part Signatures
You can include as many parts as required in a signature to search for a sequence of text strings.
Example: The following signature:
part=”Imperva”, part=”Secure”, part=”Sphere”
can match either of the following strings:
• abcdImpervaSecureSphere
• abcdImpervaabcdSecureSphere
• abcdImpervaabcdSecure---Sphere
Different parts should be separated by a comma. White spaces are allowed before and after the comma.
Absolute Modifiers
Absolute modifiers limit the part to be matched to a specific area of a stream.
The absolute modifiers that are supported are:
• amin: The absolute position in the stream to start matching this part.
• amax: The absolute position in the stream to stop matching this part.
Example: The following signature searches for the string cmd.exe only from position 10 to position 20 in the stream.
part=”cmd.exe”, amin=”10”, amax=”20”
You can include absolute modifiers after any part by using commas. You can either add a single modifier or both modifiers for each part.
Relative Modifiers
Relative modifiers limit the part to a specific area after the previous part.
The supported relative modifiers are:
• rmin: The position, relative to the previous part to start searching for this part.
• rmax: The position, relative to the previous part to stop searching for this part.
Example: The following signature includestwo parts. The second part is searched for in a range of 10
characters from the first part.
part=”cmd”, part=”.exe”, rmax=”10”
The string cmd12345.exe matches this signature. However the string cmd12345678.exe does not match the signature because the “.exe” part ends 12 characters after the “cmd” part. You can include relative modifiers after any part by using commas. You can either add a single modifier or both modifiers for each part. You can also include both relative and absolute modifiers for the same part.
Relative modifiers are ignored for the first part, as the part must be relative to the previous part, which in this case does not exist.
