security.ids.snort.sigs (thread)

Problem to configure IDS with snort-wireless, Piergiorgio Venuti
Is there a Nachi.b Snort sig?, Jeffrey Lowe
- Re: Is there a Nachi.b Snort sig?, Nigel Houghton
Missing SYN flag option in SNMP over TCP?, nnposter
Avoidance of 1:1970:1 (WEB-IIS MDAC Content-Type overflow attempt), nnposter
- Re: Avoidance of 1:1970:1 (WEB-IIS MDAC Content-Type overflow attempt), nnposter
Poor detection rate by 1:716:6 (TELNET access), nnposter
snort-rules CURRENT update @ Wed Apr 28 04:15:29 2004, bmc
SHELLCODE x86 inc ebx NOOP : Risk of false positives, Jean-Michel Barbet
another THCISSLame.c sig (s/flags/flow/), rocco.s
Cisco TCP RST Exploit Signature, David A. Koran
- Re: Cisco TCP RST Exploit Signature, Matthew Watchinski
- Re: Cisco TCP RST Exploit Signature, Mark . Schutzmann
snort_acid_rh9.pdf, Maetzky, Steffen (Extern)
- RE: snort_acid_rh9.pdf, Harper, Patrick
False Positives in SID: 2307 -- "WEB-PHP PayPal Storefront arbitrary command execution attempt", Alan Whinery
need help, zhongwei shi
another sig for THCIISLame.c, rocco.s
Signature Database, Lancaster, J Jackson Contr SAF/FMPT
- RE: Signature Database, Lancaster, J Jackson Contr SAF/FMPT
- RE: Signature Database, Brian King
  - Re: RE: Signature Database, Alejandro Flores
- FW: Signature Database, Brian King
- RE: FW: Signature Database, James Ashton
  - Re: FW: Signature Database, Brian
    - Re: FW: Signature Database, Frank Knobbe
    - RE: FW: Signature Database, Brian Jameson
- RE: RE: Signature Database, Brian King
  - Re: RE: Signature Database, Matthew Jonkman
  - Re: RE: Signature Database, Matt Jonkman
    - Re: RE: Signature Database, Brian
    - Re: RE: Signature Database, Matthew Jonkman
    - Re: RE: Signature Database, Brian
    - Re: RE: Signature Database, Matthew Jonkman
- RE: FW: Signature Database, Brian King
- RE: FW: Signature Database, James Ashton
- RE: FW: Signature Database, James Ashton
  - Re: FW: Signature Database, Brian
- RE: RE: Signature Database, James Ashton
- RE: RE: Signature Database, Thompson, Jimi
- RE: RE: Signature Database, James Ashton
- RE: RE: Signature Database, Bob Walder
  - Re: RE: Signature Database, Matthew Jonkman
    - Re: RE: Signature Database, Frank Knobbe
- RE: RE: Signature Database, Bob Walder
  - Re: RE: Signature Database, Brian
- RE: RE: Signature Database, James Ashton
  - RE: RE: Signature Database, Frank Knobbe
    - RE: RE: Signature Database, Alejandro Flores
    - Re: RE: Signature Database, Matthew Jonkman
Poptop Negative Read Overflow, Coen Bakkers, Monitored Security
Microsoft MTHML URL Redirection Attempt; rev:2;, Derek Edwards
RE: commandline syntax, Nick . Foxen
Microsoft MHTML URL Redirection Vulnerability, Derek Edwards
snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, bmc
- Re: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Jason Haar
  - Re: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Bill Guyton
- RE: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Lazar, Sean
  - RE: snort-rules CURRENT update @ Thu Apr 22 20:15:51 2004, Yaakov Yehudi
Dameware Mini-Remote Exploit Signature, Mike Rabinowitz
commandline syntax...., Ryan Trost
- Re: commandline syntax...., Matt Kettler
Does HTML always escape?, Derek Edwards
- Re: Does HTML always escape?, Matt Kettler
  - untested sig for THCIISSLame.c (MS04-011 exploit), James Riden
    - Re: untested sig for THCIISSLame.c (MS04-011 exploit), Chris Reining
    - Re: untested sig for THCIISSLame.c (MS04-011 exploit), Paul Tinsley
    - Re: untested sig for THCIISSLame.c (MS04-011 exploit), Matthew Watchinski
Snort sig for LSASS Windows vulnerability - Bloodhound.Exploit.8 ??, Rich
snort-rules CURRENT update @ Sun Apr 18 19:15:23 2004, bmc
- Re: snort-rules CURRENT update @ Sun Apr 18 19:15:23 2004, Jason Alexander
IP Protocol format and sid: 1627, rico fear
Accuracy of various snort rules, Chintan Gosalia
- Re: Accuracy of various snort rules, James Riden
file upload detection., Rajeev Kapoor
sslbomb DoS sigs (MS04-011; s21sec), Mike Pomraning
false positive in sid 567, Federico Castañeda
- Re: false positive in sid 567, Brian
false positive report, Chris Bennett
- RE: false positive report, Steve Drees
  - Re: false positive report, Chris Bennett
Sig for Linux Trojan, tom
False Postive, Rob Lewis
SID 1561 WEB-MISC ?open access, Knut Bjornstad
SID 466 - False Positive, Michael Stenzel
False Positives SID 972 WEB-IIS %2E-asp access, Claude Watson
- Re: False Positives SID 972 WEB-IIS %2E-asp access, Russell Fulton
Are there any rules for the new W32.Gaobot.WX worms?, Lin Zhong
False Positive in POP3 TOP overflow attempt (SID 2109), Kynnyth Pyke
Tag rule option keyword requirement, Zultan
False Positives for SID 1838, Steve Kirk
Blubster sigs/manolito protocol, Tony Hernandez
About content field.., Anand Chiney
- Re: About content field.., Matt Kettler
  - Re: About content field.., Frank Meerkoetter
    - Re: About content field.. (stream4 flushing behaviors), Matt Kettler
false positives, Mark Gilbert
Re : Welcome to the "Snort-sigs" mailing list, 윤여원
FP on SID:2435 - with general comment, Jason Haar
Signatures for Virii and Trojans, Patrick Harper
Worm Signatures, Chintan Gosalia
- Re: Worm Signatures, Matt Kettler
  - Re: Worm Signatures, Jason Haar
    - Re: Worm Signatures, Stef
    - Re: Worm Signatures, Matt W.
    - Re: Worm Signatures, Matt Kettler
SigSuggest : Sober.F, Benoit Donneaux
- Important, Chintan Gosalia
  - Re: Important, Michael Sconzo
    - RE: Important, Brian Jameson
  - Re: Important, Matt Kettler
lovgate.f, Petar Jurković
Strange signatures, Xavier Mesquida
- Re: Strange signatures, Daniel J. Roelker
signature 488, Gema de Toro Sánchez
False positive on rules SID=2182, Patrick Monfette
Re: snort whitelist, Michael Richardson
Re: Snort SIG update - false positives on SID 2329, Dr. Christoph Wegener
Rule format anomaly for sid 1024 & 1809, Sean Wheeler
- Re: Rule format anomaly for sid 1024 & 1809, Brian
Duplicate reference for sig 2337, Sean Wheeler
Duplicate reference for sig 1480, Sean Wheeler
Duplicate reference for sig 2178, Sean Wheeler
Duplicate reference for sig 2260, Sean Wheeler
Duplicate reference entries for sig 2259, Sean Wheeler
Worm signature question, ids
- Re: Worm signature question, Jason Haar
[1/2OT] Suggestions for rules design for base64 encoded SPAM, Stef
PHILIP LJUNGBERG/U44457/KBC_BANK is out of the office., philip . ljungberg
Odd HTTP hits on 2 signatures, Hugo van der Kooij
- RE: Odd HTTP hits on 2 signatures, Tyler Hudak
Problem to configure snort wireless, piergiorgiovenuti\@libero\.it
RE: WEB-IIS Translate update..., Milani Paolo
- Re: WEB-IIS Translate update..., Milani Paolo