Hi all. I am attempting to write rules to detect the deserialization attack payload below, which is encoded with base64. I noticed that the Suricata team now recommends using from_base64 instead of the base64_decode + base64_data keywords. However, after writing the rule and testing it, the rule di…

Require some example for from_base64 keyword

Jeff_Lucovsky (Jeff Lucovsky) October 25, 2024, 12:48pm 5

Change the offset value to 9

The from_base64 transform receives a buffer starting with {"ap0": "AA..."}. Using offset positions the decode starting point to AA...

2 Likes

Topic		Replies	Views
Suricata url_decode and base64_decode rule keyword Help	1	482	November 30, 2020
Suricata url_decode and base64_decode Rules	1	551	August 19, 2020
My suricata is not alerting me with the rule I created Rules rules , suricata	3	560	July 31, 2023
Byte_jump rule parsing error when using from_end Rules	2	613	April 8, 2020
Missing Alert - http.request body (alone) and http.request_body/url_decode in a single rule Rules	2	997	January 4, 2021