[Snort-sigs] Re: correction and new rule about keyloggers

On  0, Chich Thierry <thierry.chich@ac-clermont.fr> wrote:
> Le Mercredi 26 Avril 2006 17:06, Nigel Houghton a écrit :
> > On  0, Chich Thierry <thierry.chich@ac-clermont.fr> wrote:
> > > The first rule I have sent was a little buggy. A "|" was lacking. Thanks
> > > to rmkml.
> > >
> > > alert tcp $HOME_NET any -> any 25 (msg:"LOCAL TEST - elitekeylogger v1.0
> > > report"; flow:established;content:"MAIL FROM|3a|<logs@logs.com>";
> > > tag:session,60,seconds;classtype:policy-violation;sid:1200604131;rev:1;)
> >
> > Is there a space between the ":" and the <logs... in that Mail From
> > line?
>
> No. There is space in the body of the mail (this what we are seeing in the 
> source of the email): 
> From: <logs@...
>
> But this is generated by the mail server. The keylogger just writes: 
> MAIL FROM:<logs@.. 
> in the second step of the SMTP protocol.

ok, excellent.

+--------------------------------------------------------------------+
     Nigel Houghton      Research Engineer       Sourcefire Inc.
                   Vulnerability Research Team

         There is no theory of evolution, just a list
            of creatures Vin Diesel allows to live.


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs