Using negative distance to create detection windows
Summary: Cisco Talos described a Snort detection technique that uses negative distance and within modifiers to match the width, height, and style parameters of a hidden iframe in any order, since HTML does not require those parameters to appear in a fixed sequence. The rule matches "<iframe " followed by width=1, then searches 40 bytes before or after for height=1 and style=visibility:hidden, covering the 41-byte parameter string without entering the PCRE engine.
Key Takeaway: The technique carries a known false-positive risk because hidden iframes are also used legitimately, and Snort stops evaluating the rule entirely if a negative distance moves the cursor before the start of the buffer, so a width parameter near the buffer's beginning produces no alert at all.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026