Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for in the payload of the suspected packets? alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG. "BACKDOOR SIG - SubSseven 22";flags:

A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert

Question

Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for in the payload of the suspected packets? alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msG. "BACKDOOR SIG - SubSseven 22";flags:

A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids, 485;) alert

Accepted Answer

B. Snort will look for 0d0a5b52504c5d3030320d0a in the payload.

Answer

A. The payload of 485 is what this Snort signature will look for.

Answer

C. Packets that contain the payload of BACKDOOR SIG - SubSseven 22 will be flagged.

Answer

D. From this snort signature, packets with HOME_NET 27374 in the payload will be flagged.

Simon is security analyst writing signatures for a Snort node he placed internally that captures all mirrored traffic from his border firewall. From the following signature, what will Snort look for…

Question

Options

How the community answered

Community Discussion