security.ids.snort.sigs (thread)

Yahoo, Hotmail, and unauth sigs, Natthew Jonkman
- Re: Yahoo, Hotmail, and unauth sigs, Nigel Houghton
  - Re: Yahoo, Hotmail, and unauth sigs, Nigel Houghton
    - Re: Yahoo, Hotmail, and unauth sigs, Matthew Jonkman
    - Re: Yahoo, Hotmail, and unauth sigs, Nigel Houghton
    - Re: Yahoo, Hotmail, and unauth sigs, Matthew Jonkman
    - Re: Yahoo, Hotmail, and unauth sigs, Chris Kronberg
- RE: Yahoo, Hotmail, and unauth sigs, Kreimendahl, Chad J
Problem with SID 2514?, larosa, vjay
- Re: Problem with SID 2514?, Matthew Watchinski
- Re: Problem with SID 2514?, Jason
  - Re: Problem with SID 2514?, Jason
Syn, Ack, Syn/Ack, James Ashton
Problem with flow directive., Martin Buczynski
Packet Decoder, skaf
WEB-IIS ISAPI .printer not triggering in Snort 2.0.x, Coen Bakkers, Monitored Security
gen_id in suppress and threshold rules, Russell Fulton
- Re: gen_id in suppress and threshold rules, Russell Fulton
  - Re: gen_id in suppress and threshold rules, Brian
- Re: gen_id in suppress and threshold rules, Nerijus Krukauskas
- Re: gen_id in suppress and threshold rules, Gary_Portnoy
Snort Rule optimizer, skaf
- Re: Snort Rule optimizer, Daniel J. Roelker
  - Re: Snort Rule optimizer, Jennifer Steffens
WEB-FRONTPAGE /_vti_bin/ access rule question to the community, Coen Bakkers, Monitored Security
DDOS Shaft Client Rule and False Postives, Mark
Questions about sid: 721, Steven Bairstow
Kibuv.Worm signature anyone?, Sumeet SINGH
- Re: Kibuv.Worm signature anyone?, Nigel Houghton
- RE: Kibuv.Worm signature anyone?, Tony Bunce
  - Re: Kibuv.Worm signature anyone?, Matthew Watchinski
- Re: Kibuv.Worm signature anyone?, Martin Overton
- RE: Kibuv.Worm signature anyone?, Tony Bunce
how current are snort signatures ?, Hari Krishnan
- Re: how current are snort signatures ?, Frank Knobbe
Interest in signatures for older JRun vulnerabilities?, nnposter
- RE: Interest in signatures for older JRun vulnerabilities?, James Ashton
  - RE: Interest in signatures for older JRun vulnerabilities?, nnposter
massive rule update coming, Brian
Packet Payload database?, Scott Zawalski
- Re: [Snort-sigs] Packet Payload database?, Rodrigo Ramos
- Re: Packet Payload database?, Matthew Watchinski
  - Re: Packet Payload database?, todb
Email Collector Agent Rule, Giles . Caunter
- Re: Email Collector Agent Rule, Hugo van der Kooij
multiple interfaces, Kimberly Ho
- Re: multiple interfaces, Jason
  - Re: multiple interfaces, Jason Haar
    - Re: multiple interfaces, Jason
- Re: multiple interfaces, Javier Fernandez-Sanguino
  - Re: multiple interfaces, Matthew Watchinski
    - Re: multiple interfaces, Javier Fernandez-Sanguino
Suggested modification of rule 1892 (SNMP null community string attempt), James Kingston
- Re: Suggested modification of rule 1892 (SNMP null community string attempt), Matthew Watchinski
False positives for sid:230, Eric Watkins
- RE: False positives for sid:230, Brian King
  - Re: RE: False positives for sid:230, Matthew Watchinski
- RE: False positives for sid:230, Brian King
winmx bad sig, Charles Lacroix
- Re: winmx bad sig, Nigel Houghton
Flowbits updates, Kreimendahl, Chad J
Signature contributions, nnposter
- RE: Signature contributions, VanBrecht, Jason
Snort 2.1.3RC1 and Rule 538 and 2470, Gary_Portnoy
ICQ sigs, Charles Lacroix
Ignoring Win32 SNMP printer checks, nnposter
- RE: Ignoring Win32 SNMP printer checks, Shawn Cannon
- RE: Ignoring Win32 SNMP printer checks, nnposter
  - Re: RE: Ignoring Win32 SNMP printer checks, Nerijus Krukauskas
Bobax/Kibuv Windows XP UPnP SCAN, Miner, Jonathan W (CSC) (US SSA)
- Re: Bobax/Kibuv Windows XP UPnP SCAN, Chris Baker
  - Re: Bobax/Kibuv Windows XP UPnP SCAN, Joe Stewart
    - Re: Bobax/Kibuv Windows XP UPnP SCAN, Jason Haar
- Re: Bobax/Kibuv Windows XP UPnP SCAN, Matthew Jonkman
- Re: Bobax/Kibuv Windows XP UPnP SCAN, Aaron W. DeLashmutt
- Re: Bobax/Kibuv Windows XP UPnP SCAN, Paul Schmehl
  - Re: Bobax/Kibuv Windows XP UPnP SCAN, Joe Stewart
- RE: Bobax/Kibuv Windows XP UPnP SCAN, Miner, Jonathan W (CSC) (US SSA)
Re: Snort-sigs digest, Vol 1 #935 - 2 msgs, John Fuge
SID 1432 false positive to report, Ryan Barrett
- Re: SID 1432 false positive to report, MAYFIELD, MARK
False positives for SID 972, Gunnar Wolf
- RE: False positives for SID 972, nnposter
- RE: False positives for SID 972, nnposter
David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka
- David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka
SDBot.worm.Gen, Froon, E.W.M. (Edwin)
Suggestion to cut down on FP for generic overflow rules, Russell Fulton
- Re: Suggestion to cut down on FP for generic overflow rules, Brian
  - Re: Suggestion to cut down on FP for generic overflow rules, Alec H. Peterson
    - Re: Suggestion to cut down on FP for generic overflow rules, Brian
    - Re: Suggestion to cut down on FP for generic overflow rules, Russell Fulton
    - Re: Suggestion to cut down on FP for generic overflow rules, Brian
lots of false +ves for WEB-MISC SSLv3 invalid Client_Hello attempt, Russell Fulton
snortrules-snapshot-2_1.tar.gz not being updated?, Alec H. Peterson
- Re: snortrules-snapshot-2_1.tar.gz not being updated?, Stephan Scholz
RE: 2522 WEB-MISC SSLv3 invalid Client_Hello attempt FP's, Miner, Jonathan W (CSC) (US SSA)
- RE: 2522 WEB-MISC SSLv3 invalid Client_Hello attempt FP's, Kenneth G. Arnold
- RE: 2522 WEB-MISC SSLv3 invalid Client_Hello attempt FP's, Steven Lundberg
strange classtype question, 장영선
- strange classtype question, 장영선
  - Re: strange classtype question, James Riden
Update for sid #721 - false positives, lixantrope
.map files updated, but .rules files not for 2_1. CURRENT is OK, McCash, John
Sid 1627 false pos on novell cluster heartbeat, Andy_Bach
SID 498 False Negative, Erik Richter
False negatives on 1:491:6 (INFO FTP Bad login), nnposter
False positives for 1748, Javier Fernandez-Sanguino
shellcode false positives, Paul Tinsley
crappy rule for icmp floods, Lazar, Sean
- Re: crappy rule for icmp floods, James Riden
  - Re: crappy rule for icmp floods, Jeff Kell
erroneus bugtraq reference in SID 846?, Federico Petronio
Rules to detect recent Serv-u vulnerabilities, Javier Fernandez-Sanguino
snort-rules 2.1.* update @ Thu May 6 14:15:34 2004, bmc
- Possible False Positive in sid:2514?, Michael Sconzo
  - Re: Possible False Positive in sid:2514?, Joe Stewart
snort-rules CURRENT update @ Thu May 6 14:15:34 2004, bmc
False positives on 1:1054:6 (WEB-MISC weblogic/tomcat .jsp view source attempt), nnposter
Kerberos login failure detection, Micheal Cottingham
- Re: Kerberos login failure detection, Sean Lazar
  - Re: Kerberos login failure detection, Micheal Cottingham
Perhaps a new worm type using MS MHTML parsing vulnerability (MS04013 : CAN-2004-0380), Benoit Donneaux
- Perhaps a new worm type using MS MHTML parsing vulnerability (MS04013 : CAN-2004-0380), Benoit Donneaux
LSA Exploit rule, Jens-Harald . Johansen
- 2522 WEB-MISC SSLv3 invalid Client_Hello attempt FP's, Matthew Jonkman
SID 1432 & Correcting false positives., Barnes Brandon Amn AFWA/SCHS
Duplicated sids, Federico Petronio
- Re: Duplicated sids, Paul Schmehl
  - Re: Duplicated sids, Brian
SIDs, Keith A. Pachulski
- Re: SIDs, Brian
False +ves for IMAP list overflow attempt, Russell Fulton
RE: no references to MS04-011 in 2.1 NetBIOS ruleset ?, Moyer, Shawn
- Administrivia (Was Re: no references to MS04-011 in 2.1 NetBIOS ruleset ?), Chris Green
Sasser rules report 20040503-1452, benoit . donneaux
Sasser rules report [20040503-1456], benoit . donneaux
signature : Windows Lsasrv.dll Remote Universal Exploit XP/2K (MS04-011), Aaron W. DeLashmutt
False Positives with SIDs 2505 and 2506?, Timothy Wright
- RE: False Positives with SIDs 2505 and 2506?, adam.w.hogan
- RE: False Positives with SIDs 2505 and 2506?, Gary_Portnoy
  - RE: False Positives with SIDs 2505 and 2506?, Chris Keladis
    - Re: False Positives with SIDs 2505 and 2506?, Brian
- RE: False Positives with SIDs 2505 and 2506?, Gary_Portnoy
snort-rules 2.1.* update @ Sat May 1 14:15:27 2004, bmc
Re: FW: Signature Database, Mike Poor
- Re: RE: Signature Database, Mike Poor
  - Re: RE: Signature Database, Matthew Jonkman
WEB-IIS PCT overflow attempt, Aaron W. DeLashmutt
snort-rules CURRENT update @ Sat May 1 14:15:27 2004, bmc
no references to MS04-011 in 2.1 NetBIOS ruleset?, Jason Haar
- Re: no references to MS04-011 in 2.1 NetBIOS ruleset?, Martin Roesch
  - Re: no references to MS04-011 in 2.1 NetBIOS ruleset?, Jason Haar
    - Re: no references to MS04-011 in 2.1 NetBIOS ruleset?, Eric Jacobsen
  - Re: no references to MS04-011 in 2.1 NetBIOS ruleset?, Brian
- Re: no references to MS04-011 in 2.1 NetBIOS ruleset?, Mark . Schutzmann