security.ids.snort.sigs (date)

security.ids.snort.sigs (date)

April 30, 2003

Netbios rules are case sensitive?, Jason Haar
Re: False Positive on SMTP HELO Overflow, Jason Haar
Re: False Positive on SMTP HELO Overflow, Matthew Callaway
Re: False Positive on SMTP HELO Overflow, Erik Alexander Løkken

April 29, 2003

Re: logging session using tagging, Christophe VG
Re: logging session using tagging, Erek Adams
Lovgate.F port 445 rule, Tom . Mclaughlin
Lovgate.F rule, Tom . Mclaughlin
Re: porn.rules, Bryan Irvine

April 28, 2003

porn.rules, Bryan Irvine
Re: False Positive on SMTP HELO Overflow, Matt Kettler
False Positive on SMTP HELO Overflow, Ron Shuck
RE: what does this command do?, Matt Kettler
RE: what does this command do?, Schmehl, Paul L
what does this command do?, stormshadow
RE: more on logs, Nigel Houghton <nigel.houghton@xxxxxxxxxxxxxx>
logging session using tagging, Christophe VG

April 25, 2003

RE: ftp rules question - why only external to intern al?, Matt Kettler
RE: ftp rules question - why only external to intern al?, Jerry . L . Rose
Re: ftp rules question - why only external to internal?, Terence Runge
Re: ftp rules question - why only external to internal?, Brian
Re: Mike Sands/ITS/Element K is out of the office., Matt Kettler
RE: ftp rules question - why only external to intern al?, L. Christopher Luther
RE: more on logs, L. Christopher Luther
RE: Issue with rule sid 255, Geoff Craig
Re: Issue with rule sid 255, Brian
ftp rules question - why only external to internal?, Jerry . L . Rose
RE: Issue with rule sid 255, Geoff Craig
Re: Mike Sands/ITS/Element K is out of the office., Michael Scheidell
Re: Issue with rule sid 255, Brian
RE: Mike Sands/ITS/Element K is out of the office., Esler, Joel Contractor
Re: Mike Sands/ITS/Element K is out of the office., Michael Scheidell
Mike Sands/ITS/Element K is out of the office., Mike_Sands

April 24, 2003

Re: more on logs, Hugo van der Kooij
more on logs, Bryan Irvine
Re: Lots of triggers from NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt, Johnathan Norman

April 23, 2003

RE: cmd.exe and iisamples, Robert Reid
RE: cmd.exe and iisamples, Jerry . L . Rose
RE: cmd.exe and iisamples, L. Christopher Luther
RE: cmd.exe and iisamples, Esler, Joel Contractor
cmd.exe and iisamples, Bryan Irvine
Re: Strange question, Matt Kettler
Re: Strange question, Bennett Todd
Re: Snort logs, Robson Paniago Vasconcelos
Strange question, Bryan Irvine
Re: Lots of triggers from NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt, Brian
Re: Snort logs, Hugo van der Kooij
Re: Lots of triggers from NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt, Johnathan Norman

April 22, 2003

Snort logs, Bryan Irvine
Lots of triggers from NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt, Ian Macdonald
Issue with rule sid 255, Geoff Craig
Strange ICMP Log, Ron Shuck

April 21, 2003

Snort Signaturte option, byte_test and byte_jump, HQ-Amorelle Ong

April 20, 2003

jackhammer, Danny Shurett

April 17, 2003

SID 1362, Anton Chuvakin
SID 1361, Anton Chuvakin
SID 1360, Anton Chuvakin
SID 1359, Anton Chuvakin
SID 1358, Anton Chuvakin
snort-rules CURRENT update @ Wed Apr 16 21:16:04 2003, bmc
Mark Fuller/US/ABNAMRO/NL is out of the office., mark . fuller
Mark Fuller/US/ABNAMRO/NL is out of the office., mark . fuller
Re: newbie quistion, Matt Kettler
newbie quistion, David Davis
snort-rules STABLE update @ Wed Apr 16 21:16:04 2003, bmc
look better fifmiqf, Errol Oconnor
snort-rules CURRENT update @ Wed Apr 16 20:16:11 2003, bmc

April 16, 2003

Re: P2P Question, Dirk Mueller
P2P Question, Trevor Daucsavage
Re: newby quistin, Matt Kettler
Problems with SID 1432, Sam Evans
newby quistin, David Davis

April 15, 2003

Re: SID 1042 and WebDAV, Russell Fulton
Re: SID 1042 and WebDAV, Jason Haar
SID 1042 and WebDAV, Scott, Joshua
SID 1042 and WebDAV, Scott, Joshua
Troj.KillAV Sig, Glen Joseph

April 14, 2003

Re: newbie post, Matt Kettler
WhiteHat Web Server Fingerprinter Signatures, Ryan . Barnett

April 13, 2003

David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka

April 12, 2003

Re: newbie post, Mark Cooper
David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka

April 11, 2003

Re: Problems with SID 498: ATTACK RESPONSES id check returned root, Russell Fulton
newbie post, Bryan Irvine
RE: Problems with SID 498: ATTACK RESPONSES id check returned root, Sam Evans
Re: Problems with SID 498: ATTACK RESPONSES id check returned root, Chris Green
RE: Problems with SID 498: ATTACK RESPONSES id check returned root, Kenneth G. Arnold
RE: SMTP From Comment Overflow rule problems, Bob Dehnhardt
RE: Problems with SID 498: ATTACK RESPONSES id check returned root, Sam Evans
RE: Problems with SID 498: ATTACK RESPONSES id check returned root, Jacob Hurley
Re: Problems with SID 498: ATTACK RESPONSES id check returned root, Sam Evans
RE: Problems with SID 498: ATTACK RESPONSES id check returned root, Esler, Joel Contractor
Re: Problems with SID 498: ATTACK RESPONSES id check returned root, Kenneth G. Arnold
Problems with SID 498: ATTACK RESPONSES id check returned root, Sam Evans
I'm very new to snort, please help, Ray Pierce
fw: Possible rule for samba-2.2.XX exploit, Jacob Hurley
RE: [Snort-sigs] SMTP From Comment Overflow rule problems, Ron Shuck
Re: Possible rule for samba-2.2.XX exploit, Joerg Weber
Re: Possible rule for samba-2.2.XX exploit, Brian
RE: SMTP From Comment Overflow rule problems, Jacob Hurley
Re: rule documentation, Brian
Re: New SMB_COM_TRANSACTION alerts look pretty "broken", Brian
Rule for Sebek2 Traffic, Andrew Hintz \(Drew\)

April 10, 2003

RE: Snort newbie having trouble with using rule for detecting WebDAV exploit, Matt Yackley
Snort newbie having trouble with using rule for detecting WebDAV exploit, Jason Richardson
snort 1.9.x signatures and snort 1.8.x signatures, William_Metcalf
netric/eSDee dhcpd exploit rule., Alberto Gonzalez
Re: tftp rules classtypes confusing, Chris Green
Possible rule for samba-2.2.XX exploit, Joerg Weber

April 09, 2003

tftp rules classtypes confusing, Miller, Eoin
Re: rule documentation, Chris Green
rule documentation, Johnathan Norman

April 08, 2003

RE: snort-rules STABLE update @ Mon Apr 7 13:41:13 2003, Jacob Hurley

April 07, 2003

newbie post, Bryan Irvine
Apologize, Jose Ramon Hernandez Macias
Sigs for /sumthin and Rst.b backdoor, Joe Stewart
SMTP From Comment Overflow rule problems, Ron Shuck
RE: Demande d'aide, John Hally
snort-rules CURRENT update @ Mon Apr 7 13:41:13 2003, bmc
snort-rules STABLE update @ Mon Apr 7 13:41:13 2003, bmc
references for sid:220 (BACKDOOR HideSource backdoor attempt), Carl Gibbons
Re: Demande d'aide, Saad Kadhi
RE: Demande d'aide, Esler, Joel Contractor
Re: Demande d'aide, Joe Stewart
RE: Sig for gpuser@xxxxxxxx, John Hally
Demande d'aide, Dari Dorine

April 06, 2003

New SMB_COM_TRANSACTION alerts look pretty "broken", Jason Haar
Sig for gpuser@xxxxxxxx, JP Vossen

April 05, 2003

Re: creating new sigs [newbie], Chris Hare, CISSP, CISA
Re: creating new sigs [newbie], Matt Kettler
RADIUS attributes detection, desconocido
creating new sigs [newbie], Chris Hare, CISSP, CISA
RE: Question about sid: 1002, Jacob Hurley
Re: Questions 101 & Dire Straits, JP Vossen

April 04, 2003

Re: snortrules-stable bug patches, Matt Kettler
Re: Sendmail Signature, Matt Kettler
Re: Sendmail Signature, Muhammad Faisal Rauf Danka
Re: snortrules-stable bug patches, Michael Scheidell
RE: Question about sid: 1002, Daniel J. Roelker
Rootkit signatures, Jukka Juslin
Re: Question about sid: 1002, Michael Boman
Re: Sendmail Signature, Bennett Todd
Sendmail Signature, linux snort
snortrules-stable bug patches, Snort user
snortrules-current bug patches, Snort user
RE: Question about sid: 1002, Jacob Hurley

April 03, 2003

Re: Question about sid: 1002, Paul Schmehl
Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., Jose Ramon Hernandez Macias
Re: Questions 101, Matt Kettler
Re: Questions 101, Matt Kettler
Suspected False Positives - SID 2102, Jeff Oliveto
Hotmail, ricardo@xxxxxxxxxxx
Proposed sig to spot internal Klez infections, Kenneth G. Arnold
Re: Question about sid: 1002, Brian
Re: Questions 101, Chris Green
RE: Questions 101, Esler, Joel Contractor
Re: Question about sid: 1002, Paul Schmehl
Questions 101, Esler, Joel Contractor
snort-rules CURRENT update @ Thu Apr 3 15:18:07 2003, bmc
Re: Question about sid: 1002, Daniel J. Roelker
Re: Question about sid: 1002, daniel.clemens
Re: Question about sid: 1002, Paul Schmehl
Re: Question about sid: 1002, Brian
Re: Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., James Ainslie
Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., Jose Ramon Hernandez Macias
Sendmail Signature, linux snort
Re: Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., Alberto Gonzalez
Re: Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., Michael Scheidell

April 02, 2003

Question about sid: 1002, Paul Schmehl
snort-rules CURRENT update @ Wed Apr 2 17:20:39 2003, bmc
snort-rules STABLE update @ Wed Apr 2 17:20:39 2003, bmc
Jose Ramon Hernandez Macias/Sistemas/Megacentro/Alestra is out of the office., Jose Ramon Hernandez Macias
Quicktime Overflow Exploit Sig, SoloNet Newsfeed Processor
Re: SID 275: Eats CPU, Erek Adams
SID 275: Eats CPU, Lars Jørgensen IT

April 01, 2003

RE: Snort sig for the Security bit?, Casper van Eersel
Snort sig for the Security bit?, David T Hollis
snort-rules CURRENT update @ Tue Apr 1 06:25:07 2003, bmc
Typo in reference for sid 2090, Dale Handy

News | FAQ | advertise