EQGRP_sniffer_xml2pcap

rule EQGRP_sniffer_xml2pcap {
	meta:
		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
		id = "c284ac58-923c-5c34-b420-e87797915233"
	strings:
		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
	condition:
		1 of them
}