Forest Global Training Partners

Cyber Risks · Cisco Talos

Rawbytes is not the modifier you're looking for

Summary: Cisco Talos reports that misuse of the rawbytes content modifier in custom Snort rules is a common error, noting the modifier exists only for legacy Telnet-related cases and that just two rules outside the Telnet category use it today. Using rawbytes on an HTTP header or URI undoes the normalization and de-obfuscation performed by the http_inspect preprocessor, making rules evadable by encoded strings such as "t%72iv%69a%6c".

Why it matters: A rule that inspects raw HTTP bytes instead of normalized traffic can be bypassed with simple percent-encoding, so the detection you believe is watching a URI or header may never fire against an attacker who encodes it.

Read the original at Cisco Talos ↗

Topics
Malware
Related