py-idstools
py-idstools copied to clipboard
Error when parsing Unicode in URL
Specific example for current ET Trojan ruleset : https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-trojan.rules
alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN KHRAT DragonOK DNS Lookup (inter-ctrip .com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|inter-ctrip|03|com|00|"; nocase; distance:0; fast_pattern; metadata: former_category TROJAN; reference:url,blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok’s-new-custom-backdoor; classtype:trojan-activity; sid:2024108; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2017_03_29, performance_impact Low, updated_at 2017_03_29;)
Running gensidmsgmap creates exception
Traceback (most recent call last):
File "/usr/bin/idstools-gensidmsgmap", line 12, in <module>
sys.exit(main())
File "/usr/lib/python2.7/site-packages/idstools/scripts/gensidmsgmap.py", line 131, in main
print(idstools.rule.format_sidmsgmap(rules[rule_id]))
UnicodeEncodeError: 'ascii' codec can't encode character u'\u2019' in position 156: ordinal not in range(128)
For some reason a special character is used in the URL reference of the ET rule and gensidmsgmap can't handle it.