Snort IDS Signatures Development (thread)

[Snort-sigs] help for contribute new rule webmin miniserv.pl format string, rmkml, 2005/11/30
[Snort-sigs] FP with sid 1399 (WEB-PHP PHP-Nuke remote file include attempt), rmkml, 2005/11/29
[Snort-sigs] new rule for detect recently cisco web access, rmkml, 2005/11/29
- Re: [Snort-sigs] new rule for detect recently cisco web access, Brian Caswell, 2005/11/29
[Snort-sigs] odd rule behaviour ???, Russell Fulton, 2005/11/28
- Re: [Snort-sigs] odd rule behaviour ???, Frank Knobbe, 2005/11/28
- Re: [Snort-sigs] odd rule behaviour ???, Patrick Walsh, 2005/11/28
- Re: [Snort-sigs] odd rule behaviour ???, Joel Esler, 2005/11/28
[Snort-sigs] new rule for detect icmp undefined code (>18), rmkml, 2005/11/27
[Snort-sigs] Getting FPs for EXPLOIT CDE dtspcd exploit attempt from WoW traffic, Russell Fulton, 2005/11/23
[Snort-sigs] PFs for NETBIOS SMB SMB_COM_TRANSACTION Max Parameter and Max Count of 0 DOS Attempt, sid:2101, Russell Fulton, 2005/11/23
[Snort-sigs] new rule for detect Jetty source code disclosure, rmkml, 2005/11/23
[Snort-sigs] FP for sid 2000538, Chich Thierry, 2005/11/23
- Re: [Snort-sigs] FP for sid 2000538, Chich Thierry, 2005/11/23
[Snort-sigs] Confirmed Coverage of Microsoft IE Proof of Concept Exploit, Sourcefire VRT, 2005/11/22
[Snort-sigs] FP on NETBIOS SMB-DS Trans2 FIND_FIRST2 response overflow attempt, Russell Fulton, 2005/11/21
[Snort-sigs] FP on "NETBIOS SMB-DS Trans2 FIND_FIRST2 response andx overflow attempt", Jason Haar, 2005/11/21
- Re: [Snort-sigs] FP on "NETBIOS SMB-DS Trans2 FIND_FIRST2 response andx overflow attempt", Brian Caswell, 2005/11/23
[Snort-sigs] FPs for NETBIOS DCERPC ISystemActivator path overflow attempt little endian,Sig ID,3197, Russell Fulton, 2005/11/21
[Snort-sigs] FP for 2001621 (PHP Injection Attack), Chich Thierry, 2005/11/21
[Snort-sigs] FP 100000122 mod_jrun, Chich Thierry, 2005/11/21
- Re: [Snort-sigs] FP 100000122 mod_jrun, Chich Thierry, 2005/11/21
  - Re: [Snort-sigs] FP 100000122 mod_jrun, Chich Thierry, 2005/11/23
[Snort-sigs] new rule for detect smtp open relay test message, rmkml, 2005/11/19
[Snort-sigs] new rule for detect IMAP Qualcomm WorldMail SELECT dot dot attempt, rmkml, 2005/11/18
- Re: [Snort-sigs] new rule for detect IMAP Qualcomm WorldMail SELECT dot dot attempt, Blake Hartstein, 2005/11/18
[Snort-sigs] Confirmed Coverage for MSRPC UPnP DoS, Sourcefire VRT, 2005/11/17
[Snort-sigs] Changing the Community sid-msg.map, Alex Kirk, 2005/11/17
- Re: [Snort-users] Changing the Community sid-msg.map, Richard Harman, 2005/11/18
[Snort-sigs] new rule for detect gnu mailman utf8 attachement, rmkml, 2005/11/16
[Snort-sigs] Three new rule for detect Wizz Forum sql attempt, rmkml, 2005/11/16
[Snort-sigs] new rule for detect phpSysInfo vulnerabilities (HTTP_ACCEPT_LANGUAGE), rmkml, 2005/11/15
- Re: [Snort-sigs] new rule for detect phpSysInfo vulnerabilities (HTTP_ACCEPT_LANGUAGE), Nigel Houghton, 2005/11/15
[Snort-sigs] Two rules detecting video streams, Chich Thierry, 2005/11/14
- Re: [Snort-sigs] Two rules detecting video streams, Alex Kirk, 2005/11/14
  - Re: [Snort-sigs] Two rules detecting video streams, Chich Thierry, 2005/11/14
[Snort-sigs] new rule for detect SAP WAS syscmd access, rmkml, 2005/11/13
- Re: [Snort-sigs] new rule for detect SAP WAS syscmd access, Frank Knobbe, 2005/11/13
  - Re: [Snort-sigs] new rule for detect SAP WAS syscmd access, rmkml, 2005/11/13
    - Re: [Snort-sigs] new rule for detect SAP WAS syscmd access, Frank Knobbe, 2005/11/13
[Snort-sigs] new rule for detect Cross-Site Scripting php attempt, rmkml, 2005/11/13
[Snort-sigs] Sourcefire VRT Certified Rules Update, Sourcefire VRT, 2005/11/13
[Snort-sigs] new rule for detect apache (1.3/2.0) dir browsing|list, rmkml, 2005/11/13
[Snort-sigs] VRT Advisory - Confirmed Coverage for Lupper/Plupii Worm, Sourcefire VRT, 2005/11/13
[Snort-sigs] new rule for detect JBoss JMXInvokerServlet access, rmkml, 2005/11/13
[Snort-sigs] mail from snort to administrator ?, Zahra Taghikhaki, 2005/11/13
[Snort-sigs] new rule for detect Vubb Path disclosure, rmkml, 2005/11/13
- Re: [Snort-sigs] new rule for detect Vubb Path disclosure, Alex Kirk, 2005/11/13
[Snort-sigs] new rule for detect "Sip Send Fun" (tool to exploit VoIP) and other, rmkml, 2005/11/13
[Snort-sigs] new rule for detect FlatFrag game DoS exploit, rmkml, 2005/11/04
[Snort-sigs] new rule for detect phpinfo access !, rmkml, 2005/11/04
[Snort-sigs] new rule for detect Battle Carry Dos, rmkml, 2005/11/04
[Snort-sigs] FP for psyBNC - sig 493, Chris Edwards, 2005/11/04
[Snort-sigs] FP on "NETBIOS SMB spoolss AddPrinterEx WriteAndX unicode overflow attempt", Jason Haar, 2005/11/03
- Re: [Snort-sigs] FP on "NETBIOS SMB spoolss AddPrinterEx WriteAndX unicode overflow attempt", Jason Haar, 2005/11/04
  - Re: [Snort-sigs] FP on "NETBIOS SMB spoolss AddPrinterEx WriteAndX unicode overflow attempt", Brian Caswell, 2005/11/04
[Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2005/11/03
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2005/11/13
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2005/11/14
- [Snort-sigs] Snort Community Rules Update, Sourcefire VRT, 2005/11/16
[Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/03
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/03
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/04
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/13
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/15
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/16
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/18
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/19
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/20
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/21
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/22
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/23
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/24
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/25
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/26
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/29
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/29
- [Snort-sigs] Bleedingsnort.com Daily Update, bleeding, 2005/11/30
Re: [Snort-sigs] i want to update my snort rules but i don't know how can i do?, Jack Pepper, 2005/11/01
RE: [Snort-sigs] add cert on reference.config file ?, Michael Scheidell, 2005/11/01
Re: [Snort-sigs] Rebuilding snort server and sensors, Charles Lacroix, 2005/11/01
[Snort-sigs] Sig ID 3000, lanceb, 2005/11/01