Why this simple rule is not working
alert ftp any any -> any any (msg:"FILE PDF file claimed";
fileext:"pdf"; filestore; sid:2; rev:1;)
It could not detect any pdf file transported by filezela as example
Why this simple rule is not working
alert ftp any any -> any any (msg:"FILE PDF file claimed";
fileext:"pdf"; filestore; sid:2; rev:1;)
It could not detect any pdf file transported by filezela as example
The most likely answer is that the dynamic protocol detection is failing to identify the connection as FTP. You may want to start with something simpler. To see if the protocol detector sees that connection as FTP, you could try this:
With no rule options, this should generate an alert for every packet in the stream after FTP is detected.