This scenario is about creating a Custom Attack Definition that uses numeric enumeration match to detect if the HTTP response code is either 302 or 404.
In order to write a proper Native Trellix IPS Format Custom Attack for this example, you must identify several key elements:
Application protocol: HTTP
Protocol field: rsp-code
Enumeration value (integer): 302 and 404
Steps to create the attack definition for this example:
In the Custom Attack Editor, click
.png)
.The New Custom Attack interface opens.
.png)
Select one of the options from the State drop-down menu.
You can specify a name such as "Custom Exploit: Numeric Enumeration Match" as the Name.
The letters "UDS" (user-defined signature) are appended to the front of the name upon completion; thus, this attack appears as "UDS-Custom Exploit: Numeric Enumeration Match" in the Custom Attack Editor, as well as the attack database when you save in the Manager server.
Type a description for your attack. This area can be used for your notes or other specific information pertinent to your new attack.
You can select Medium (5) as the Severity because this example scenario does not necessarily involve malicious activity.
Select Advanced Protection Options/Web Application Server as the Protection Category.
Select Custom Exploit (Signature Based) from the Detection Type drop-down menu for the attack.
Click Next.
.png)
Select Client or Server as Attack Target.
Select Attack Packet Only as Blocking (As Applicable).
In the Matching Criteria section, select Protocol as the Criterion and select http as the protocol.
When you subsequently save this attack definition in the Manager server, it will be part of every rule set which includes Medium-severity, HTTP attacks (must match both severity and protocol).
.png)
Attack details configuration is complete. Continue to create signature.