I am testing the rule on a machine I know is vulnerable, however the
signature isn't triggering an alert. I understand the syntax but I am having
trouble with
-----Original Message-----
From: Keith W. McCammon [mailto:mccammon@gmail.com]
Sent: Monday, September 13, 2004 10:13 AM
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] help with LSASS rule
Are you looking for help understanding syntax (in which case you
should see the docs) or something specific related to this rule?
"; depth:4; offset:4; nocase; content:"|05|";
distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|";
within:2; distance:19;
thanks
----- Original Message -----
From: Wohlberg, Jonathan <jwohlberg@btfiloh.org>
Date: Mon, 13 Sep 2004 08:26:14 -0400
Subject: [Snort-sigs] help with LSASS rule
To: snort-sigs@lists.sourceforge.net
I am trying to figure out how this rule works. Any help breaking it
down would be appreciated.
Jon
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS
DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt";
flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt;
content:"|FF|SMB"; depth:4; offset:4; nocase; content:"|05|";
distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|";
within:2; distance:19; reference:bugtraq,10108;
reference:cve,2003-0533;
reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx;
classtype:attempted-admin; sid:2514; rev:7;)
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
