Re: snort signature for W32/Blaster?
From: alex (ntnewsNOSPAM_at_hrz3.hrz.tu-darmstadt.de)
Date: 08/15/03
- Next message: G. Wolfe Woodbury: "Re: GNU servers release code 'owned' by crackers"
- Previous message: Peter Makholm: "Re: Why are there few viruses for UNIX/Linux systems?"
- In reply to: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Next in thread: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Reply: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 15 Aug 2003 22:56:37 +0200
> posting you found a solution without posting the solution suxxx.
the solution i found is only for 2.0 and not my 1.8.4 - therefor the problem
is OPEN. sorry... if you have an idea - let me know.
this is for 2.0
alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"NETBIOS DCERPC
ISystemActivator bind attempt"; flow:to_server,established; content:"|05|";
distance:0; within:1; content:"|0b|"; distance:1; within:1;
byte_test:1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00
00 00 46|"; distance:29; within:16; reference:cve,CAN-2003-0352;
classtype:attempted-admin; sid:2192; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB DCERPC
ISystemActivator bind attempt"; flow:to_server,established;
content:"|FF|SMB|25|"; nocase; offset:4; depth:5; content:"|26 00|";
distance:56; within:2; content:"|5c 00|P|00|I|00|P|00|E|00 5c 00|"; nocase;
distance:5; within:12; content:"|05|"; distance:0; within:1; content:"|0b|";
distance:1; within:1; byte_test:1,&,1,0,relative; content:"|A0 01 00 00 00
00 00 00 C0 00 00 00 00 00 00 46|"; distance:29; within:16;
reference:cve,CAN-2003-0352; classtype:attempted-admin; sid:2193; rev:1;)
Alex
- Next message: G. Wolfe Woodbury: "Re: GNU servers release code 'owned' by crackers"
- Previous message: Peter Makholm: "Re: Why are there few viruses for UNIX/Linux systems?"
- In reply to: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Next in thread: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Reply: Ken Kauffman: "Re: snort signature for W32/Blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
