Re: [Snort-sigs] Storm worm rule

--On Wednesday, February 13, 2008 13:54:13 -0800 Matt Jonkman 
<jonkman@jonkmans.com> wrote:

> We've had this one covered in emerging threats sigs (botht he regular
> edonkey and the encrypted ones) for a very long time now.
>
> Were you running these, and if so were they not hitting?

Matt, if this is what you're referring to, it's not what I'm interested in.

alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"BLEEDING-EDGE 
TROJAN Storm Worm Encrypted Traffic Inbound - Likely Connect Ack"; dsize:2; 
threshold: type threshold, count 10, seconds 60, track by_dst; 
classtype:trojan-activity; sid:2007635; rev:1;)

There's no detection for the eDonkey protocol.  A dsize of 2 may be unusual, 
but it won't be unique.  Perhaps with the threshold false positives are 
reduced, but I'm trying to improve my snort-fu by writing rules that are 
extremely accurate in what they detect, and that requires protocol detection 
within the payload.

-- 
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs