This article provides a sample configuration example on how to create a custom signature-based IDP attack objects in SRX series platforms.

To block against a behavior that may not exploit an actual vulnerability.  Example: downloading of exe files using FTP should be blocked

For these type of scenarios, we have to create custom signatures to prevent the undesirable conditions.

Create a signature-based attack object called myattack. This attack object is used to block any user trying to download files of type extension exe using FTP.

CLI Configuration:

[edit security]
root@srx# show idp 
idp-policy testidp {
    rulebase-ips {
        rule 1 {
            match {
                from-zone trust;
                source-address any;
                to-zone untrust;
                destination-address any;
                application default;
                attacks {
                    custom-attacks myattack;
                }
            }
            then {
                action {
                    drop-connection;
                }
                notification {
                    log-attacks;
                }
            }
        }
    }
}                                       
active-policy testidp;
custom-attack myattack {
    severity major;
    attack-type {
        signature {
            context ftp-get-filename;
            pattern ".*\.\[exe\]";
            direction client-to-server;
        }
    }
}

[edit security]

root@srx#

Note:
Please note that this custom signature is based on regular expressions. Proper care should be taken while writing regular expressions, as many mistakes can be made by not following the rules governed by regex (regular expressions).

For more examples of custom attack object regular expressions:

IDP Series Custom Attack Objects Reference and Examples

• Configuring IDP Signature-Based Attacks (CLI)