[Snort-sigs] Bleedingsnort.com Daily Update

[***] Results from Oinkmaster started Thu Jan  6 21:00:03 2005 [***]

[*] Rules modifications: [*]
    None.

[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-attack_response.rules (1):
        #alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Successful user 
connection after Brute Force Attack"; flowbits:isset,ssh.brute.attempt; 
threshold:type both, track by_src, count 2, seconds 60; dsize:100; flags:AP; 
classtype:successful-user; rev:2;)

[---]     Removed non-rule lines:    [---]

     -> Removed from bleeding-attack_response.rules (1):
        alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SSH Successful user 
connection after Brute Force Attack"; flowbits:isset,ssh.brute.attempt; 
threshold:type both, track by_src, count 2, seconds 60; dsize:100; flags:AP; 
classtype:successful-user; rev:2;)

[*] Added files: [*]
    None.



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs