[***] Results from Oinkmaster started Thu Nov 4 20:00:02 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-policy.rules (4):
#alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED XLS in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".xls"; nocase;
classtype:not-suspicious; flow:established; sid:2001403; rev:2;)
#alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED DOC in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".doc"; nocase;
classtype:not-suspicious; flow:established; sid:2001402; rev:2;)
#alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED PPT in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".ppt"; nocase;
classtype:not-suspicious; flow:established; sid:2001405; rev:2;)
#alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED EXE in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".exe"; nocase;
classtype:not-suspicious; flow:established; sid:2001404; rev:2;)
[---] Removed rules: [---]
-> Removed from bleeding-policy.rules (4):
alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED XLS in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".xls"; nocase;
classtype:not-suspicious; flow:established; sid:1001403;)
alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED PPT in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".ppt"; nocase;
classtype:not-suspicious; flow:established; sid:1001405;)
alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED DOC in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".doc"; nocase;
classtype:not-suspicious; flow:established; sid:1001402;)
alert tcp any any -> any any (msg:"BLEEDING-EDGE ZIPPED EXE in
transit"; content:"|50 4B 03 04|"; content:"|00|"; content:".exe"; nocase;
classtype:not-suspicious; flow:established; sid:1001404;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (4):
2001402 || BLEEDING-EDGE ZIPPED DOC in transit
2001403 || BLEEDING-EDGE ZIPPED XLS in transit
2001404 || BLEEDING-EDGE ZIPPED EXE in transit
2001405 || BLEEDING-EDGE ZIPPED PPT in transit
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (4):
1001402 || BLEEDING-EDGE ZIPPED DOC in transit
1001403 || BLEEDING-EDGE ZIPPED XLS in transit
1001404 || BLEEDING-EDGE ZIPPED EXE in transit
1001405 || BLEEDING-EDGE ZIPPED PPT in transit
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
