[Snort-sigs] Storm worm rule

This is a packet capture of a known storm-infected host.  Normal data payload 
size is either 2 bytes or 25 bytes.

0000  00 0f 23 aa 37 40 00 0d  ed ac 93 40 81 00 00 02   ..#.7@.. ...@....
0010  08 00 45 00 00 35 85 2b  00 00 74 11 ef 1c 81 6e   ..E..5.+ ..t....n
0020  f1 06 80 67 df 93 f7 9b  1c 52 00 21 94 10 10 a6   ...g.... .R.!....
0030  4b 69 53 29 56 b1 29 22  8b a9 ad 3c 22 0b 3a 8d   KiS)V.)" ...<".:.
0040  e2 53 17 15 81 49 46                               .S...IF

The signature |10 a6| at byte 47 is the indication of an encrypted eDonkey 
session (typically used by Storm along with UDP.

So, would this be the correct syntax?  alert udp blah(msg:"blah"; dsize:2<>25; 
content:"|10 a6|"; offset:47; blah.  Or am I missing something?

-- 
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs