inliniac/suricata — pull request #174 by dabarb1 (2012-11-05 20:42:21+00:00)
Title: Portable Executable header anomaly scanner

Updated revision 3

Added thread local storage for scanned bytes and other misc fixes

This patch details the changes made to the Suricata baseline for integrating the PEScan service. The service involves creating a detection engine keyword 'pescan' that matches when a PE file is detected via a byte scanner, or when the file has an anomaly score that meets certain condition criteria. In addition, when PE files are detected, their header and anomaly flag information is logged to a separate file (pescan.log) using the logging module.