|
|
January 28, 2004
- Here are my updated MyDoom/MIMAIL.R and Variant signatures for Snort, sam
- Re: FW: Mydoom/Novarg/Shimg Rule idea, Eric Hines
- Re: W32.Novarg.A worm rule stuff, Andreas Östling
- FW: Mydoom/Novarg/Shimg Rule idea, CMartin
- Mydoom/Novarg/Shimg Rule idea, CMartin
- Addition to SID 1497 - False Positive, Bryan Allerdice
- Re: NULL for payload?, scott
- Re: NULL for payload?, scott
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Bryan Irvine
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Bryan Irvine
- NULL for payload?, scott
- Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Joe Stewart
- Microsoft Network Monitoring Agent signature, Steven Bairstow
- Signature for "W32_Novarg_SCO_DOS", Robert Reid
- RE: [Snort-sigs] Signature for "W32_Novarg_SCO_DOS", larosa, vjay
- Re: Novarg Virus, Steven Bairstow
- Re: Novarg Virus, sam
- Re: W32.Novarg.A worm rule stuff, James Riden
- Re: W32.Novarg.A worm rule stuff, sam
- Re: W32.Novarg.A worm rule stuff, Dale L. Handy
- Novarg Virus, bclark
January 27, 2004
- RE: W32.Novarg.A worm rule stuff, Shimniok, Michael
- RE: W32.Novarg.A worm rule stuff, Adrian Marsden
- Sid 480 False Positive Info, Michael Hale Ligh
- Re: W32.Novarg.A worm rule stuff, Johnathan Norman
- Any working signatures for Novarg Worm Yet?, Marty . Bostick
- Re: W32.Novarg.A worm rule stuff, Joe Matusiewicz
- RE: W32.Novarg.A worm rule stuff, Cam Beasley, ISO
- Re: W32.Novarg.A worm rule stuff, Nick Cross
- Snortrule with sid 1292, Lutz Schildt
- RE: Hi, Tony Hernandez
- Re: W32.Novarg.A worm rule stuff, Johnathan Norman
- RE: New Worm / Virus - WORM_MIMAIL.R?, CGhercoias
- W32.Novarg.A worm rule stuff, Johnathan Norman
- stateless modificator/option, a a
- Re: New Worm / Virus - WORM_MIMAIL.R?, sam
January 22, 2004
- Re: Detecting telnets port 25, 80, Jason Haar
- New Snort rule, GIB L'Obreli
- Possible False Positive for SID 2182, dude 1
- bagle signature, Laurent FACQ
- Ftp Monitoring and Tracking, suliman
- New Signature: WinMX connection initiation, Colin Grady
- Re: beagle signature?, Brian Eckman
- Re: beagle signature?, sam
- Re: W32/SWEN.A signature, Chris Kronberg
- RE: beagle signature?, Cam Beasley, ISO
- beagle signature?, Manuel Garcia-Cervigon
January 14, 2004
- Re: URGENT: How to add new rules???, Matt Kettler
- URGENT: How to add new rules???, Chintan Gosalia
- Signature for H.323 exploitation?, Chip Kelly
- Re: ORing of contents, Matt Kettler
- Signature for H.323 exploitation?, Chip Kelly
- False positive for SID 2105, Orion Poplawski
- RE: Restart Snort to apply new rules?, Kreimendahl, Chad J
- Re: .map files, Andreas Östling
- snort-rules CURRENT update @ Wed Jan 14 03:15:26 2004, bmc
- Joe Callen/BMC/BHA is out of the office., JoeCallen
- ORing of contents, Chintan Gosalia
- Re: Question regarding OR, Michael Boman
- snort-rules CURRENT update @ Tue Jan 13 19:15:20 2004, bmc
January 13, 2004
- Re: Question regarding OR, james
- Question regarding OR, Chintan Gosalia
- Re: Restart Snort to apply new rules?, Russell Fulton
- Re: pass rule won't take - SOLVED, ICO Staff
- .map files, Albers, Lucas
- Re: Restart Snort to apply new rules?, Edin Dizdarevic
- New Rule, Luiz Carlos
- Restart Snort to apply new rules?, jchrisos1
- SID 1653, Colin Harford
- SID 1042, Colin Harford
- Rule update, Chris McMahon
- Re: (no subject), Michael Boman
- (no subject), Robert Almeida
January 12, 2004
- Re: please remove me from your email list. thanks, Matt Kettler
- please remove me from your email list. thanks, gfyspf@xxxxxxxxx
- SID 1432 false positives, Orion Poplawski
- Rule 1242 update, Chris McMahon
- SID 1214 - WEB-MISC intranet access, Bob Van Cleef
- Rule update, Chris McMahon
- SID 839 typo, Colin Harford
- Rule 2067 update, Chris McMahon
- Rule 1002 update, Chris McMahon
- False Positive DDOS shaft client-to-handler, John Waters
- RE: pass won't take, Keen Joe L SrA HQ SSG/DOIN
- Re: pass rule won't take - REVISED, Frank Knobbe
- Re: pass rule won't take - REVISED, Andreas Östling
- pass rule won't take - REVISED, ICO Staff
- pass won't take, ICO Staff
|
|
