I do not have a pcap for it. This was a preemptive signature based
off of the virus info. Please not to write me asking for pcap
anymore. If I had one, it would be given to the people at VRT.
---------- Forwarded message ----------
From: Blake Hartstein <bhartstein@demarc.com>
Date: May 23, 2006 12:35 PM
Subject: Re: Fwd: [Snort-sigs] Rule for MSWord GinWin.
To: Ureleet Ureleet <ureleet@gmail.com>
Cc: rmkml@free.fr
Send that pcap my way too if it is available.
Thanks,
Blake
Ureleet Ureleet wrote:
---------- Forwarded message ----------
From: rmkml <rmkml@free.fr>
Date: May 23, 2006 7:59 AM
Subject: Re: [Snort-sigs] Rule for MSWord GinWin.
To: Ureleet Ureleet <ureleet@gmail.com>
Hi,
thx,
do you have snort output or pcap file ?
Best Regards
Rmkml
On Tue, 23 May 2006, Ureleet Ureleet wrote:
Date: Tue, 23 May 2006 07:31:27 -0400
From: Ureleet Ureleet <ureleet@gmail.com>
To: snort-sigs@lists.sourceforge.net
Subject: [Snort-sigs] Rule for MSWord GinWin.
I have written a rule to detect the MS Word virus GinWin vulnerability
on our network, and am sharing with community.
It's not the best rule, and I hope VRT comes out with something
better, but this rule basically looks for the dns queries that the
virus performs.
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"COMMUNITY VIRUS
GinWui infected host"; content:"|01 00|"; offset:2; depth:2;
pcre:"/((\x05scfzf\x04xicp\x03net)|(\x0alocalhosts\x043322\x03org))/Ri";
rev:1;)
Please review.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with pre-integrated technology to make your
job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
--
This email and any files transmitted with it are solely intended for
the use of the addressee(s) and may contain information that is
confidential and privileged. If you receive this email in error,
please advise us by return email immediately. Please also disregard
the contents of the email, delete it and destroy any copies
immediately. Demarc Security, Inc. does not accept liability for the
views expressed in the email or for the consequences of any computer
viruses that may be transmitted with this email.
This email is also subject to copyright. No part of it should be
reproduced, adapted or transmitted without the written consent of the
copyright owner.
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
