Re: [Snort-sigs] Storm worm rule

--On Wednesday, February 13, 2008 14:03:32 -0800 Matt Jonkman 
<jonkman@jonkmans.com> wrote:

> If you search the wiki for "storm worm" there are a number of hits, some
> of the rules are gone now though (failed experiments on just tracking
> dsize in udp).
>
> But these two ought to catch what you're looking for:
>
> http://doc.emergingthreats.net/bin/view/Main/2007701
> http://doc.emergingthreats.net/bin/view/Main/2007702
>
> And if you run the regular edonkey sigs you'll catch the old
> non-encrypted variant quite well.
>
> http://doc.emergingthreats.net/bin/view/Main/WebSearch?search=edonkey
>
>
> As for the search: what can I do to make that easier? Did you just
> search the main site vs the wiki?

I originally searched the main website for "storm worm" which turned up nothing 
except links to news items and a sig for the download of the valentine worm. 
When I searched the wiki for "Storm worm" I found the rules.

-- 
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs