Andrews Carl 448 <Carl.Andrews@crackerbarrel.com> writes:
Why do my questions not get posted? I am a member of the list.
-----Original Message-----
From: Andrews Carl 448
Sent: Friday, August 20, 2004 12:30 PM
To: Andrews Carl 448; 'snort-sigs@lists.sourceforge.net'
Subject: RE: Snort Rule Howto
-----Original Message-----
From: Andrews Carl 448
Sent: Thursday, August 19, 2004 2:10 PM
To: snort-sigs@lists.sourceforge.net
Subject: Snort Rule Howto
Hi! If anyone can help, it would be much appreciated.
I need to write a rule(s) to block certain types of files from
crossing the network to/from a computer. For instance, I would like to
use the FLEXRESP option to terminate a connection if and EXE,DLL,ZIP,
etc is copied to or from this server.
The short answer is I think you'll have too many false positives to do
it this way; I certainly had to turn some similar snort rules off
because they were firing on people discussing '.exe' files in
email and web pages.
Otherwise, bleedingsnort.com has some rules about executable files I
believe - they would be a good starting point.
cheers,
Jamie
--
James Riden / j.riden@massey.ac.nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
