security.ids.snort.sigs (date)

security.ids.snort.sigs (date)

April 30, 2004

Re: Is there a Nachi.b Snort sig?, Nigel Houghton
Problem to configure IDS with snort-wireless, Piergiorgio Venuti
Is there a Nachi.b Snort sig?, Jeffrey Lowe
Re: Avoidance of 1:1970:1 (WEB-IIS MDAC Content-Type overflow attempt), nnposter

April 29, 2004

Missing SYN flag option in SNMP over TCP?, nnposter
Re: RE: Signature Database, Matthew Jonkman

April 28, 2004

RE: RE: Signature Database, Alejandro Flores
Avoidance of 1:1970:1 (WEB-IIS MDAC Content-Type overflow attempt), nnposter
Poor detection rate by 1:716:6 (TELNET access), nnposter
Re: RE: Signature Database, Frank Knobbe
RE: RE: Signature Database, Frank Knobbe
Re: RE: Signature Database, Matthew Jonkman
RE: RE: Signature Database, James Ashton
Re: RE: Signature Database, Brian
Re: Cisco TCP RST Exploit Signature, Mark . Schutzmann
RE: FW: Signature Database, Brian Jameson
RE: RE: Signature Database, Bob Walder
RE: RE: Signature Database, Bob Walder
snort-rules CURRENT update @ Wed Apr 28 04:15:29 2004, bmc
Re: RE: Signature Database, Matthew Jonkman
Re: Cisco TCP RST Exploit Signature, Matthew Watchinski
Re: RE: Signature Database, Brian
Re: FW: Signature Database, Frank Knobbe
RE: RE: Signature Database, James Ashton

April 27, 2004

Re: RE: Signature Database, Matthew Jonkman
RE: RE: Signature Database, Thompson, Jimi
Re: FW: Signature Database, Brian
Re: RE: Signature Database, Brian
RE: snort_acid_rh9.pdf, Harper, Patrick
RE: RE: Signature Database, James Ashton
Re: RE: Signature Database, Matt Jonkman
Re: RE: Signature Database, Matthew Jonkman
RE: FW: Signature Database, James Ashton
Re: FW: Signature Database, Brian
RE: FW: Signature Database, James Ashton
SHELLCODE x86 inc ebx NOOP : Risk of false positives, Jean-Michel Barbet
RE: FW: Signature Database, Brian King
another THCISSLame.c sig (s/flags/flow/), rocco.s
Cisco TCP RST Exploit Signature, David A. Koran
snort_acid_rh9.pdf, Maetzky, Steffen (Extern)
False Positives in SID: 2307 -- "WEB-PHP PayPal Storefront arbitrary command execution attempt", Alan Whinery
need help, zhongwei shi
another sig for THCIISLame.c, rocco.s
Re: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Bill Guyton
Re: untested sig for THCIISSLame.c (MS04-011 exploit), Matthew Watchinski
RE: RE: Signature Database, Brian King
RE: FW: Signature Database, James Ashton
Re: RE: Signature Database, Alejandro Flores
FW: Signature Database, Brian King
RE: Signature Database, Brian King
Re: untested sig for THCIISSLame.c (MS04-011 exploit), Paul Tinsley

April 26, 2004

RE: Signature Database, Lancaster, J Jackson Contr SAF/FMPT
Signature Database, Lancaster, J Jackson Contr SAF/FMPT

April 25, 2004

RE: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Yaakov Yehudi

April 24, 2004

Poptop Negative Read Overflow, Coen Bakkers, Monitored Security
Microsoft MTHML URL Redirection Attempt; rev:2;, Derek Edwards

April 23, 2004

RE: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Lazar, Sean
RE: commandline syntax, Nick . Foxen
Re: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Jason Haar
Microsoft MHTML URL Redirection Vulnerability, Derek Edwards
snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, bmc

April 22, 2004

Re: untested sig for THCIISSLame.c (MS04-011 exploit), Chris Reining
Re: commandline syntax...., Matt Kettler

April 21, 2004

Dameware Mini-Remote Exploit Signature, Mike Rabinowitz
commandline syntax...., Ryan Trost
untested sig for THCIISSLame.c (MS04-011 exploit), James Riden
Re: Does HTML always escape?, Matt Kettler
Does HTML always escape?, Derek Edwards

April 20, 2004

Snort sig for LSASS Windows vulnerability - Bloodhound.Exploit.8 ??, Rich

April 19, 2004

Re: snort-rules CURRENT update @ Sun Apr 18 19:15:23 2004, Jason Alexander
snort-rules CURRENT update @ Sun Apr 18 19:15:23 2004, bmc
Re: false positive report, Chris Bennett
IP Protocol format and sid: 1627, rico fear

April 16, 2004

Re: Accuracy of various snort rules, James Riden
Accuracy of various snort rules, Chintan Gosalia

April 15, 2004

file upload detection., Rajeev Kapoor
sslbomb DoS sigs (MS04-011; s21sec), Mike Pomraning
RE: false positive report, Steve Drees
Re: false positive in sid 567, Brian
false positive in sid 567, Federico Castañeda
false positive report, Chris Bennett
Sig for Linux Trojan, tom
False Postive, Rob Lewis

April 14, 2004

SID 1561 WEB-MISC ?open access, Knut Bjornstad

April 12, 2004

Re: False Positives SID 972 WEB-IIS %2E-asp access, Russell Fulton

April 09, 2004

SID 466 - False Positive, Michael Stenzel

April 08, 2004

False Positives SID 972 WEB-IIS %2E-asp access, Claude Watson
Are there any rules for the new W32.Gaobot.WX worms?, Lin Zhong
False Positive in POP3 TOP overflow attempt (SID 2109), Kynnyth Pyke
Re: About content field.. (stream4 flushing behaviors), Matt Kettler

April 07, 2004

Re: About content field.., Frank Meerkoetter
Re: Worm Signatures, Matt W.
Tag rule option keyword requirement, Zultan
False Positives for SID 1838, Steve Kirk
Re: About content field.., Matt Kettler
Re: Worm Signatures, Matt Kettler
Blubster sigs/manolito protocol, Tony Hernandez
RE: Important, Brian Jameson
About content field.., Anand Chiney
Re: Worm Signatures, Stef
false positives, Mark Gilbert
Re : Welcome to the "Snort-sigs" mailing list, 윤여원

April 06, 2004

Re: Worm Signatures, Jason Haar
FP on SID:2435 - with general comment, Jason Haar
Re: Worm Signatures, Matt Kettler
Re: Important, Matt Kettler
Signatures for Virii and Trojans, Patrick Harper
Re: Important, Michael Sconzo
Worm Signatures, Chintan Gosalia
Important, Chintan Gosalia
SigSuggest : Sober.F, Benoit Donneaux

April 05, 2004

lovgate.f, Petar Jurković
Re: Strange signatures, Daniel J. Roelker
Strange signatures, Xavier Mesquida
signature 488, Gema de Toro Sánchez
False positive on rules SID=2182, Patrick Monfette
Re: snort whitelist, Michael Richardson
Re: Snort SIG update - false positives on SID 2329, Dr. Christoph Wegener

April 03, 2004

Re: Rule format anomaly for sid 1024 & 1809, Brian
Rule format anomaly for sid 1024 & 1809, Sean Wheeler
Duplicate reference for sig 2337, Sean Wheeler
Duplicate reference for sig 1480, Sean Wheeler
Duplicate reference for sig 2178, Sean Wheeler
Re: Worm signature question, Jason Haar
Duplicate reference for sig 2260, Sean Wheeler
Duplicate reference entries for sig 2259, Sean Wheeler
Worm signature question, ids

April 02, 2004

[1/2OT] Suggestions for rules design for base64 encoded SPAM, Stef
RE: Odd HTTP hits on 2 signatures, Tyler Hudak
PHILIP LJUNGBERG/U44457/KBC_BANK is out of the office., philip . ljungberg

April 01, 2004

Odd HTTP hits on 2 signatures, Hugo van der Kooij
Re: WEB-IIS Translate update..., Milani Paolo
Problem to configure snort wireless, piergiorgiovenuti\@libero\.it
RE: WEB-IIS Translate update..., Milani Paolo

News | FAQ | advertise