Rules
# You could even do slightly more fingerprinting; however, I think
this is more then enough to weed out false positives
# EB | OFFSET | 58-5B | 31 | C0,C9,D2,DB | B0-B3 | XX | 8B (| XX |
05,2D,35,81,C1???) ... (random)
# ... 40-43,FD,FF | 40-43,FF | 40-43,80,FF |
40-43,E9-EB,FF,80,2C | 40-43,48-4B,E9-EB,01,2C,80 | 48-4C,E9-EB,02,2C
|
# | 48-4B,03 | 48-4B | 74 | 07 | EB | OFFSET | E8 | OFFSET
alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"SHELLCODE CLET
polymorphic payload"; classtype:shellcode-detect; \
dsize: >40; \
content: "|74 07 eb|"; \
content: "|e8|"; distance: 1; within: 1; \
content: "|ff ff ff|"; distance: 1; within: 3; \
pcre:
"/\xeb.[\x58-\x5b]\x31[\xc0\xc9\xd2\xdb][\xb0-\xb3].\x8b.[\x05\x2d\x35\x81\xc1]/sm";
\
pcre:
"/[\x40-\x43\xfd\xff][\x40-\x43\xff][\x40-\x43\x80\xff][\x40-\x43\xe9-\xeb\xff\x80\x2c][\x40-\x43\x48-\x4b\xe9-\xeb\x01\x2c\x80][\x48-\x4c\xe9-\xeb\x02\x2c][\x03\x48-\x4b][\x48-\x4b]\x74\x07\xeb.\xe8.\xff\xff\xff/smR";)
# Detects payloads <1024 bytes, you could do slightly more
fingerprinting if you split them up but this should be very accurate
by itself.
alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"SHELLCODE Shikata Ga
Nai polymorphic payload"; classtype:shellcode-detect; \
dsize: >26; \
content: "|d9 74 24 f4|"; \
pcre: "/[\x29\x2b\x31\x33]\xc9/sm"; \
pcre:
"/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-\x5f]/sm";
\
# MSF 2
pcre:
"/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^\x00\xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^\x00][^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc][\x03\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c\x0e-\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|"
\
# MSF 3
"([\x29\x2b\x31\x33\xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][\x24\xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf\xd9][^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc][\x03\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/sm";)
# You could do slightly more if you wanted. And it could be done very
accurately dynamically by parsing out useless nops but this works too.
# No good distinguishing patterns other then E8 XX FF FF FF... Oh, and
if you wanted to re-write this using byte_jumps it would be REALLY
good because all of these loops/calls/jmps land exactly on an
instruction so you dont have to do .{0,20} but I don't have the
time... do you? :-)
alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"SHELLCODE ADMutate
polymorphic payload"; classtype:shellcode-detect; \
dsize: >45; \
content: "|e8|"; \
content: "|ff ff ff|"; distance: 1; within: 3; \
pcre:
"/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83\xec\x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0\x91))|((\x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|\x6a.\x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b\x06\x09\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].{0,20}\xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";)
--