[Snort-sigs] New bleeding virus rules (Korgo.P)

Noticed that there haven't been very many additions to the bleedingvirus 
rules set lately, decided that it was time to contribute. I hope to 
contribute more later.

These are the first rules I've written based off wire captures as 
opposed to mail attachments or simple content searching, so any comments 
are appreciated.

alert tcp $HOME_NET any -> any 445 (msg:"Korgo.P offering executable"; 
content:"|FF|SMB"; \ flow:to_server,established; depth:10; 
content:"|58|http"; content:".exe"; nocase; within:36; \ 
reference:url,www.f-secure.com/v-descs/korgo_p.shtml; rev:1; sid:2800002;)

alert tcp $HOME_NET any -> any any (msg:"Korgo.P binary upload"; \ 
content:"|aa4f7ea86c90457d686868f0de687a68689768686868|"; \ 
reference:url,www.f-secure.com/v-descs/korgo_p.shtml; rev:1; sid:2800003;)

-Nick


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs