security.ids.snort.sigs (thread)

P2P ed2k/edonkey ping, Michael Patzer
Bug w/fix: snort 2.1.0 won't make under OpenBSD 3.4, Snort user
- Re: Bug w/fix: snort 2.1.0 won't make under OpenBSD 3.4, Mark Nipper
RE: [Snort-users] Re: New Worm / Virus - WORM_MIMAIL .R?, Shimniok, Michael
Any signatures on Mimail.S, Juhi Flower
RE: MyDoom/Novarg, Martin Jr., D. Michael
Looking for Mimail.s signature, vaibhavi kothari
P2P ed2k (edonkey) ping, Michael Patzer
[Fwd: Auto update of sigs (was: Novarg Virus)], bclark
RE: Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Martin Jr., D. Michael
- Here are my updated MyDoom/MIMAIL.R and Variant signatures for Snort, sam
Mydoom/Novarg/Shimg Rule idea, CMartin
- Re: Mydoom/Novarg/Shimg Rule idea, Andreas Östling
- FW: Mydoom/Novarg/Shimg Rule idea, CMartin
  - Re: FW: Mydoom/Novarg/Shimg Rule idea, Eric Hines
- RE: FW: Mydoom/Novarg/Shimg Rule idea, Grejda, Eric
Addition to SID 1497 - False Positive, Bryan Allerdice
NULL for payload?, scott
- Re: NULL for payload?, Matt Kettler
  - Re: NULL for payload?, scott
  - Re: NULL for payload?, scott
Microsoft Network Monitoring Agent signature, Steven Bairstow
Signature for "W32_Novarg_SCO_DOS", Robert Reid
RE: [Snort-sigs] Signature for "W32_Novarg_SCO_DOS", larosa, vjay
Novarg Virus, bclark
- Re: Novarg Virus, sam
- Re: Novarg Virus, Steven Bairstow
Sid 480 False Positive Info, Michael Hale Ligh
Any working signatures for Novarg Worm Yet?, Marty . Bostick
Snortrule with sid 1292, Lutz Schildt
RE: Hi, Tony Hernandez
RE: New Worm / Virus - WORM_MIMAIL.R?, CGhercoias
W32.Novarg.A worm rule stuff, Johnathan Norman
- Re: W32.Novarg.A worm rule stuff, Nick Cross
  - Re: W32.Novarg.A worm rule stuff, Dale L. Handy
    - Re: W32.Novarg.A worm rule stuff, Matthew Watchinski
  - Re: W32.Novarg.A worm rule stuff, sam
- Re: W32.Novarg.A worm rule stuff, Joe Matusiewicz
  - Re: W32.Novarg.A worm rule stuff, Johnathan Norman
  - Re: W32.Novarg.A worm rule stuff, James Riden
- Re: W32.Novarg.A worm rule stuff, Johnathan Norman
- RE: W32.Novarg.A worm rule stuff, Cam Beasley, ISO
- RE: W32.Novarg.A worm rule stuff, Adrian Marsden
  - Re: W32.Novarg.A worm rule stuff, Andreas Östling
    - Re: W32.Novarg.A worm rule stuff, Brian
    - Re: W32.Novarg.A worm rule stuff, Andreas Östling
- RE: W32.Novarg.A worm rule stuff, Shimniok, Michael
stateless modificator/option, a a
W32/Dumaru, Scott, Robbie
- New Worm / Virus - WORM_MIMAIL.R?, sam
  - Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Joe Stewart
    - Re: New Worm / Virus - WORM_MIMAIL.R?, sam
    - Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Bryan Irvine
  - Re: [Snort-sigs] New Worm / Virus - WORM_MIMAIL.R?, Bryan Irvine
PCRE problems, keith loyd
- Re: PCRE problems, Brian
New Snort rule, GIB L'Obreli
Possible False Positive for SID 2182, dude 1
bagle signature, Laurent FACQ
Ftp Monitoring and Tracking, suliman
New Signature: WinMX connection initiation, Colin Grady
Re: W32/SWEN.A signature, Chris Kronberg
beagle signature?, Manuel Garcia-Cervigon
- Re: beagle signature?, sam
- Re: beagle signature?, Brian Eckman
- RE: beagle signature?, Cam Beasley, ISO
  - RE: beagle signature?, D@7@K|N&
- RE: beagle signature?, Cam Beasley, ISO
  - RE: beagle signature?, D@7@K|N&
False Postives for SID 862, bclark
size of attachment in SMTP packet, Juhi Flower
Question about SID 663, Schmehl, Paul L
- Re: Question about SID 663, Brian
Detecting telnets port 25, 80, watsons
- Re: Detecting telnets port 25, 80, Bennett Todd
  - Re: Detecting telnets port 25, 80, Jason Haar
    - Re: Detecting telnets port 25, 80, Dirk Geschke
snort-rules CURRENT update @ Sun Jan 18 20:15:23 2004, bmc
Edonkey Client Connection, Cedric Foll
Are there any signatures for these vulnerabilities???, Chintan Gosalia
snort-rules CURRENT update @ Thu Jan 15 19:15:22 2004, bmc
help needed for ICMP signature, Chintan Gosalia
- Re: help needed for ICMP signature, Matt Kettler
Help needed with confusing issue..., Kelly Slavens
- Re: Help needed with confusing issue..., Matt Kettler
URGENT: How to add new rules???, Chintan Gosalia
- Re: URGENT: How to add new rules???, Matt Kettler
Signature for H.323 exploitation?, Chip Kelly
- Signature for H.323 exploitation?, Chip Kelly
False positive for SID 2105, Orion Poplawski
snort-rules CURRENT update @ Wed Jan 14 03:15:26 2004, bmc
Joe Callen/BMC/BHA is out of the office., JoeCallen
ORing of contents, Chintan Gosalia
- Re: ORing of contents, Matt Kettler
snort-rules CURRENT update @ Tue Jan 13 19:15:20 2004, bmc
- RE: snort-rules CURRENT update @ Tue Jan 13 19:15:20 2004, D@7@K|N&
Question regarding OR, Chintan Gosalia
- Re: Question regarding OR, james
  - Re: Question regarding OR, Michael Boman
.map files, Albers, Lucas
- Re: .map files, Andreas Östling
New Rule, Luiz Carlos
Restart Snort to apply new rules?, jchrisos1
- Re: Restart Snort to apply new rules?, Edin Dizdarevic
  - Re: Restart Snort to apply new rules?, Russell Fulton
- RE: Restart Snort to apply new rules?, Kreimendahl, Chad J
SID 1653, Colin Harford
SID 1042, Colin Harford
Rule update, Chris McMahon
- Rule update, Chris McMahon
  - Rule 1002 update, Chris McMahon
  - Rule 2067 update, Chris McMahon
- Rule 1242 update, Chris McMahon
(no subject), Robert Almeida
- Re: (no subject), Michael Boman
- (no subject), tom de puysseleyr
  - Re: (no subject), Nathan Bain
please remove me from your email list. thanks, gfyspf@xxxxxxxxx
- Re: please remove me from your email list. thanks, Matt Kettler
SID 1432 false positives, Orion Poplawski
SID 1214 - WEB-MISC intranet access, Bob Van Cleef
SID 839 typo, Colin Harford
False Positive DDOS shaft client-to-handler, John Waters
pass rule won't take - REVISED, ICO Staff
- Re: pass rule won't take - REVISED, Andreas Östling
  - Re: pass rule won't take - REVISED, Frank Knobbe
    - Re: pass rule won't take - SOLVED, ICO Staff
pass won't take, ICO Staff
- RE: pass won't take, Keen Joe L SrA HQ SSG/DOIN
snort-rules CURRENT update @ Fri Jan 9 19:15:23 2004, bmc
SID :1939 MISC bootp hardware address length overflow - False P ositives, Nick . Cross
snort-rules CURRENT update @ Wed Jan 7 19:15:32 2004, bmc
snort sig #498 : false positives, Arnd Fischer
Upgrading, Esler, Joel - Contractor
- RE: Upgrading, D@7@K|N&
  - RE: Upgrading, Nathan Bain
    - RE: Upgrading, Daniel J. Roelker
- Re: Upgrading, Daniel J. Roelker
template for submitting snort signature descriptions, mwillis
false positive found for rule 1383, Nick . Cross
(http_inspect) DOUBLE DECODING ATTACK, Luke Campagnola
- Re: (http_inspect) DOUBLE DECODING ATTACK, Denny Page
  - Re: (http_inspect) DOUBLE DECODING ATTACK, Daniel J. Roelker
    - Re: (http_inspect) DOUBLE DECODING ATTACK, Daniel J. Roelker
POP3 login brute force attempt, Jeff Kell
GNUTella GET alert, Krisa . W . Rowland
IMAP login brute force attempt, Jeff Kell
Exploit-ByteVerify, Petar Jurković
- Re: Exploit-ByteVerify, Brian
Re: Signature error?, Andreas Östling