Regular Expressions 101

^start of line

Group 1(drop|reject)

1st Alternativedrop

dropthe literal text drop (case sensitive)

2nd Alternativereject

rejectthe literal text reject (case sensitive)

Group 2(.*)

.*any character (except for line terminators), repeated any number of times

noalertthe literal text noalert (case sensitive)

Group 3(.*)

.*any character (except for line terminators), repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

^(drop|reject)(.*)noalert(.*)

New

drop tcp any any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt"; flags:R; flow:to_server; flowbits:isset,ms.rdp.synack; flowbits:isnotset,ms.rdp.established; flowbits:unset,ms.rdp.synack; reference:cve,2012-0152; classtype:attempted-dos; noalert; sid:2014384; rev:8; metadata:created_at 2012_03_13, updated_at 2012_03_13;)

Regular Expression

Extraction