inliniac/suricata — pull request #744 by inliniac (2013-12-23 17:03:57+00:00)
Title: [rfc, rebase, v1.1] Portable Executable header anomaly scanner

Initial rebase of #174 against the current master.

Will be doing some more refactoring. Also, the original comments in #174 have not yet been addressed.

Fixes since https://github.com/inliniac/suricata/pull/743:
- fix rebase leftover in suricata.yaml.in, causing generated yaml to be unparseble.

Original message:

Updated revision 3: This patch details the changes made to the Suricata baseline for integrating the PEScan service. The service involves creating a detection engine keyword 'pescan' that matches when a PE file is detected via a byte scanner, or when the file has an anomaly score that meets certain condition criteria. In addition, when PE files are detected, their header and anomaly flag information is logged to a separate file (pescan.log) using the logging module.