inliniac/suricata — pull request #743 by inliniac (2013-12-23 16:22:02+00:00)
Title: [rfc, rebase] Portable Executable header anomaly scanner

Initial rebase of https://github.com/inliniac/suricata/pull/174 against the current master.

Will be doing some more refactoring. Also, the original comments in https://github.com/inliniac/suricata/pull/174 have not yet been addressed.

Original message:

Updated revision 3: This patch details the changes made to the Suricata baseline for integrating the PEScan service. The service involves creating a detection engine keyword 'pescan' that matches when a PE file is detected via a byte scanner, or when the file has an anomaly score that meets certain condition criteria. In addition, when PE files are detected, their header and anomaly flag information is logged to a separate file (pescan.log) using the logging module.