Re: [Snort-sigs] help with LSASS rule

Are you looking for help understanding syntax (in which case you
should see the docs) or something specific related to this rule?


----- Original Message -----
From: Wohlberg, Jonathan <jwohlberg@btfiloh.org>
Date: Mon, 13 Sep 2004 08:26:14 -0400
Subject: [Snort-sigs] help with LSASS rule
To: snort-sigs@lists.sourceforge.net




I am trying to figure out how this rule works. Any help breaking it
down would be appreciated.

Jon



alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS
DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt";
flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt;
content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|";
distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|";
within:2; distance:19; reference:bugtraq,10108;
reference:cve,2003-0533;
reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx;
classtype:attempted-admin; sid:2514; rev:7;)


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs