Hmmm...
alert tcp any any -> $SMTP_SERVERS 25 (msg:"Someone is failing to
unsubscribe"; content:"unsubscribe"; nocase; content:!"mailman-request@";)
Yes, it's specific to mailman, but it's a place to start. (not that I'd
actually run this rule anywhere...)
-Joe
-----Original Message-----
From: snort-sigs-admin@lists.sourceforge.net
[mailto:snort-sigs-admin@lists.sourceforge.net]On Behalf Of Nick Hatch
Sent: Saturday, March 12, 2005 2:25 PM
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] Unsubscribe
I'm not sure if any rules for detecting unsubscribe messages to email
list distribution addresses or not. I think you're right -- they would
be a good idea though.
-Nick
P.S. I know brevity is good and all, but it took me a while to figure
out what you were talking about.
Hazel, Scott A. wrote:
Unsubscribe
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
