Snort IDS Signatures Development (thread)

[Snort-sigs] rule for detect tcpdump rsvp exploit, rmkml, 2005/08/31
[Snort-sigs] False +ves on WEB-CLIENT HTML http scheme hostname overflow attempt 3550, Russell Fulton, 2005/08/31
[Snort-sigs] add new simple rule for detect "Jboss % attempt", rmkml, 2005/08/29
[Snort-sigs] Add many (180!) ref on sid, rmkml, 2005/08/28
[Snort-sigs] add new rule "HTTP Transfer-Content Request Smuggling attempt", rmkml, 2005/08/27
[Snort-sigs] new rule : SMTP Elm buffer overflow attempt, rmkml, 2005/08/27
[Snort-sigs] false msg on sid 860 ?, rmkml, 2005/08/26
[Snort-sigs] false uricontent on sid 1600 ?, rmkml, 2005/08/26
[Snort-sigs] new rule for detect 'piranha default passwd attempt', rmkml, 2005/08/26
[Snort-sigs] Remote IIS Server_Name Spoof attempt, rmkml, 2005/08/25
[Snort-sigs] OSSRC Meeting - August 25th, 2005, Jennifer Steffens, 2005/08/23
[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1463 - 1 msg, Nick Plante, 2005/08/21
[Snort-sigs] dsize - fails on rebuilt streams, James Affeld, 2005/08/19
[Snort-sigs] fix typo "/calendar-admin.pl" to "/calendar_admin.pl" on sid 1701 (snortrule24), rmkml, 2005/08/18
- Re: [Snort-sigs] fix typo "/calendar-admin.pl" to "/calendar_admin.pl" on sid 1701 (snortrule24), Nigel Houghton, 2005/08/18
[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1459 - 1 msg, Aaron Dolan, 2005/08/18
[Snort-sigs] sig 1653 content/alert typo - NOT 'campus', James Affeld, 2005/08/18
[Snort-sigs] Zotob Worm Coverage, Jennifer Steffens, 2005/08/17
[Snort-sigs] MS05-039 Updated Rules, Chris Baker, 2005/08/17
[Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), rmkml, 2005/08/16
- Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Jason, 2005/08/16
  - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), rmkml, 2005/08/16
    - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Jason, 2005/08/16
    - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), rmkml, 2005/08/16
    - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Nigel Houghton, 2005/08/16
    - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Jason, 2005/08/16
    - Re: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Erik Fichtner, 2005/08/16
- RE: [Snort-sigs] snort not detect messenger spam ? (snort240b18+snortrules24), Harper, Patrick, 2005/08/16
[Snort-sigs] Sourcefire VRT Update for Zotob Worm, Nigel Houghton, 2005/08/15
[Snort-sigs] duplicate packets checking, Igor Belikov, 2005/08/15
[Snort-sigs] MS05-039 and Zotob worm, Nigel Houghton, 2005/08/14
[Snort-sigs] MS05-039 Worm in the wild - Snort sigs attached (they are not mine), Harper, Patrick, 2005/08/14
- Re: [Snort-sigs] MS05-039 Worm in the wild - Snort sigs attached (they are not mine), purplebag, 2005/08/15
[Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2005/08/12
- [Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2005/08/18
[Snort-sigs] add new ref on multiple sid (10) [snort240b18], rmkml, 2005/08/12
[Snort-sigs] Re: Snort-sigs digest, Vol 1 #1451 - 2 msgs, Nick Plante, 2005/08/11
[Snort-sigs] Authorization overflow ?, rmkml, 2005/08/08
- Re: [Snort-sigs] Authorization overflow ?, Frank Knobbe, 2005/08/08
- RE: [Snort-sigs] Authorization overflow ?, GNSC NetDefense Correlation, 2005/08/08
[Snort-users] Re: [Snort-devel] Detecting TCP Timestamp PAWS DoS from tracefile, J.Smith, 2005/08/07
- [Snort-sigs] RE: [Snort-devel] Detecting TCP Timestamp PAWS DoS from tracefile, Steven Sturges, 2005/08/08
[Snort-sigs] add ref on sid {40} [new sid appears on snort24 rules], rmkml, 2005/08/05
[Snort-sigs] FP for sid:1107, Jeff Kell, 2005/08/05
[Snort-sigs] Glen Joseph is out of the office., Glen Joseph, 2005/08/04
[Snort-sigs] Snort/Sguil Meeting in San Francisco, CA, Jennifer Steffens, 2005/08/03
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/02
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/10
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/11
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/12
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/14
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/16
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/17
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/19
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/20
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/22
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/24
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/25
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/26
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/27
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/28
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/29
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/30
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/08/31
[Snort-sigs] FYI: docs for sid 564 wrong, Patrick Walsh, 2005/08/02