Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Sep 25, 2014

Attack Signature question

Can someone take a look at the Attack Signature below and let me know if it looks ok. I don't have much experience writing them and want to make sure I am not making some sort of big mistake.   ...
ASM Advanced WAF
attack signature
design
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Sep 25, 2014

Mike,

 

I think you need to pop a ; after the content too e.g. content: "/proc/self/fd/3"; nocase;

 

Also, do you need to escape the special characters in the headercontent? You would use the pipe | to do this. I can't be 100% on this.

 

N