inliniac/suricata — pull request #81 by dabarb1 (2012-09-21 15:53:15+00:00)
Title: PE (portable executable) anomaly scan detector and logger modules

This patch adds new 'pescan' detector keyword as well as logger module for logging and scoring header anomalies found in windows PE files that have been extracted from HTTP (and soon also from SMTP) traffic.

Implementation contains both a new shared library 'libpescan' with the pe-scanner code as well as the compiled-in modules that add the service to Suricata file extraction capability.