« SquidNT squid.conf.diff |
Main
| [norton.ipcn.org] i32 x86 说明更新 »
May 4, 2004
W32/Sasser a and b SNORT Sigs
版权声明：可以任意转载，转载时请务必以超链接形式标明文章原始出处和作者信息及本声明。
https://windtear.net/archives/2004/05/04/000328.html
W32/Sasser a and b SNORT Sigs
by Martin Overton <martin@arachnophiliac.com>
Hi,
To save my SNORT sigs board going into meltdown, I sm posting my Sasser
snort sigs here for all interested parties.
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"W32/Sasser.worm.a
[NAI])"; content:"|BC 3B 74 0B 50 8B 3D E8 46 A7 3D 09 85 B8 F8 CD 76 40
DE 7C 5B 5C D7 2A A8 E8 58 75 62 96 25 24|"; classtype:misc-
activity;rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"W32/Sasser.worm.b
[NAI])"; content:"|58 BC 0C FF 59 57 32 31 BD EC 34 64 6E D6 E3 8D 65 04
68 58 62 79 DF D8 2C 25 6A B5 28 BA 13 74|"; classtype:misc-
activity;rev:1;)
Regards,
Martin Overton
--
Anti-Malware Specialist - WildList Reporter - AVIEN Charter member
Electronic Ephemera - Hoax FAQ http://arachnophiliac.com/hoax
Arachnid and Snake Wrangler - http://arachnophiliac.com/burrow/home.htm
PGP key - http://arachnid.homeip.net/papers/other/MartinOverton.asc
QFTD='Never could any increase of comfort or security be a sufficient good
to be bought at the price of liberty.' - Hilaire Belloc
|
|
Posted by windtear at May 4, 2004 3:16 PM
