Hi all In the service http engine, you have following option:
1) Specify URI regex 2) Specify Header regex 3) Specify Request regex *Query 1* ** Let's consider a task to match "cmd.exe" anywhere in the http url. If I use option 1 and 2 with "cmd.exe", the sig triggers. But with option 2, the sig doesn't trigger. I thought, option 2 will also trigger as URI is also part of http header. *Query 2* Will "Specify Request regex" match the regex both in the the header and payload? With regards Kings
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
