Multiple "content" fields in custom IPS signatures
I rely on the help built-in to SEPM and the tech docs here a lot, however, recently I've run into a few lack of examples - the "here it is used in a real-world example". Being a visual learner, I love to see an example after an explanation.
This brings up the topic I'm questioning today. I never really caught this before - maybe it's new, maybe I just missed it all these years, but I see in the custom IPS signatures that the content apparently can appear multiple times in a signature string, unlike the other sections such as dest, saddr and so on.
They say that " Arguments that are followed by an ellipsis may be repeated."
I can "guess" because if I key in on the word "argument" then it appears as if the word content, wich is an argument, can appear more than one time. But should I interpret that help bit so literally?
It's great to see that it can appear multiple times. But what exactly does that mean, how should it be laid out?
Does that mean, for example ->
- This - content="a-string", "B-string"
- or This - content="a-string, b-string"
- or This - content="a-string", content="b-string"
A simple single example, just one of the above to follow-up the statement "Arguments that are followed by an ellipsis may be repeated" to show what that means.
How should it be written?
If an argument can be used certain ways, please show us in a real example - in a full rule that most of us might be able to "get".
At this point, I have dozens of rules that could be condensed into maybe just a small handful if I knew how the 'content' argument can be used multiple times.
I see examples in some other places - the source for example - says source, then tells what it is, then gives an example of how to use it.