Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | [Snort-sigs] Bad escape sequence? |
|---|---|
| Date: | Fri, 30 Sep 2005 09:31:57 -0400 |
I have a rule in my local.rules that i picked up somewhere on the mailing lists: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"IE suspicious access to WSH (Windows Script Host)"; flow: from_server,established; content:"object"; nocase; content:"id"; nocase; content:"wsh"; nocase; content:"classid"; nocase; content:"clsid\:"; nocase; content:"F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"; nocase; content:"\/"; nocase; content:"object"; nocase; reference: url, http.www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; classtype:misc-attack; sid:1000042; rev:1;) I just upgraded from 2.4.0 to 2.4.2 and upon launching snort i get: "bad escape sequence starting with "\/". Fatal Error, Quitting.." This used to work with 2.4.0 and before. What changed? Thanks, ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ Snort-sigs mailing list Snort-sigs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: [Snort-users] How to test snort inline, vikrant |
|---|---|
| Next by Date: | [Snort-users] Snort exit status, sekure |
| Previous by Thread: | [Snort-users] Snort 2.4.2 with ClamAV, Bill Warren |
| Next by Thread: | [Snort-users] Re: [Snort-sigs] Bad escape sequence?, dajackman |
| Indexes: | [Date] [Thread] [Top] [All Lists] |