SID 1:1390

Rule Category

INDICATOR-SHELLCODE --

Alert Message

INDICATOR-SHELLCODE x86 inc ebx NOOP

Rule Explanation

This event is generated when an attempt is made to execute shellcode on a host in the protected network from a source external to that network. Impact: This set of instructions can be used as a NOOP to pad buffers on an x86 architecture machines. Details: This is the x86 opcode for 'inc ebx'. This can be used as a NOOP in an x86 architecture, however as with all shellcode rules, this can cause false positives. Check to see if you are ignoring shellcode rules on web ports, as this will reduce false positives. Ease of Attack: This is a generic rule designed to pick up this opcode in use.

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This will false positive if rule is not ignoring clear text ports every time snort sees 24 'C' characters (hex code of 43) in a row. This is the x86 opcode for 'inc ebx'. This can be used as a NOOP in an x86 architecture, however as with all shellcode rules, this can cause false positives.

Contributors

Cisco Talos Brian Caswell Mike Poor Nigel Houghton