Re: [Snort-sigs] New bleeding virus rules (Korgo.P)

Ya, it has been quiet lately. That's a good sign though, not any killer 
outbreaks lately. Although I expect we'll be busy with some jpeg issues 
soon...

If we are all put out of business by the lack of security problems we've 
probably reached our goal. Fortunately for our families that live off 
our paranoia, that'll likely never happen. :)

Thanks for the sigs. They look very good, they're posted.

Matt

Nick Hatch wrote:
> Noticed that there haven't been very many additions to the bleedingvirus 
> rules set lately, decided that it was time to contribute. I hope to 
> contribute more later.
>
> These are the first rules I've written based off wire captures as 
> opposed to mail attachments or simple content searching, so any comments 
> are appreciated.
>
> alert tcp $HOME_NET any -> any 445 (msg:"Korgo.P offering executable"; 
> content:"|FF|SMB"; \ flow:to_server,established; depth:10; 
> content:"|58|http"; content:".exe"; nocase; within:36; \ 
> reference:url,www.f-secure.com/v-descs/korgo_p.shtml; rev:1; sid:2800002;)
>
> alert tcp $HOME_NET any -> any any (msg:"Korgo.P binary upload"; \ 
> content:"|aa4f7ea86c90457d686868f0de687a68689768686868|"; \ 
> reference:url,www.f-secure.com/v-descs/korgo_p.shtml; rev:1; sid:2800003;)
>
> -Nick
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> Use IT products in your business? Tell us what you think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
> http://productguide.itmanagersjournal.com/guidepromo.tmpl
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs