security.ids.snort.sigs (thread)

False Positive - SID 1882, Gustavo Gomes
- Re: False Positive - SID 1882, Javier Fernandez-Sanguino
False positives SID 1882, Javier Fernandez-Sanguino
[Fwd: Updated mIRC Signature], Matthew Jonkman
Last addition for now, Matthew Jonkman
Crashing snort, Matthew Jonkman
- RE: Crashing snort, Joshua Berry
  - Re: Crashing snort, Matthew Jonkman
Yesadvertising Malware sigs, Matthew Jonkman
big problems with 2.1 snapshot rules?, Eric Bowser
iroffer IRC P2P Bot signatures, Kevin Kolk
- Re: iroffer IRC P2P Bot signatures, Mister Coffee
- Re: iroffer IRC P2P Bot signatures, Matthew Watchinski
  - Re: iroffer IRC P2P Bot signatures, Matthew Jonkman
    - Re: iroffer IRC P2P Bot signatures, Nigel Houghton
    - Re: iroffer IRC P2P Bot signatures, Matthew Jonkman
    - Re: iroffer IRC P2P Bot signatures, Matthew Watchinski
New Bleeding rules submitted, Matthew Jonkman
- Re: New Bleeding rules submitted, John Nagro
  - Re: New Bleeding rules submitted, Matthew Jonkman
- Re: New Bleeding rules submitted, John Nagro
  - Re: New Bleeding rules submitted, Matthew Jonkman
- Re: New Bleeding rules submitted, Matthew Watchinski
  - Re: New Bleeding rules submitted, Matthew Jonkman
snort rules and -CURRENT for 2.1.3, Eric Jacobsen
- Re: snort rules and -CURRENT for 2.1.3, Burak DAYIOGLU
Bleeding addition, Matthew Jonkman
- Re: Bleeding addition, Brian
  - Re: Bleeding addition, Matthew Jonkman
- Re: Bleeding addition, Dan Michitsch
  - Re: Bleeding addition, Matthew Jonkman
- RE: Bleeding addition, Adrian Marsden
  - Re: Bleeding addition, Matthew Jonkman
- Re: Bleeding addition, Brian
- RE: Bleeding addition, Adrian Marsden
  - Re: Bleeding addition, Matthew Jonkman
- RE: Bleeding addition, James Ashton
- RE: Bleeding addition, Adrian Marsden
  - Re: Bleeding addition, Matthew Jonkman
False +ves for various rules..., Russell Fulton
False Positive for SID 2570, Lutz Schildt
- Re: False Positive for SID 2570, Matthew Jonkman
ack! bad virus! bad bad!, Bryan Irvine
- Re: ack! bad virus! bad bad!, Matthew Jonkman
- RE: ack! bad virus! bad bad!, Albers, Lucas
  - Re: ack! bad virus! bad bad!, Matthew Jonkman
- RE: ack! bad virus! bad bad!, Albers, Lucas
  - Re: ack! bad virus! bad bad!, Matthew Jonkman
    - Re: ack! bad virus! bad bad!, John Nagro
2515 "WEB-MISC PCT Client_Hello" FPs, sekure
- Re: 2515 "WEB-MISC PCT Client_Hello" FPs, Brian
SID 221 DDOS TFN Probe, dbs
Suspected false positive description for sid 466, Adam Johnson
Re: Snort-sigs digest, Vol 1 #977 - 7 msgs, GMUarmyRES
Ilookup Trojan, Matthew Jonkman
Joe Callen/BMC/BHA is out of the office., JoeCallen
Unknown IIS Worm Sigs, Matthew Jonkman
- Re: Unknown IIS Worm Sigs, John Nagro
  - Re: Unknown IIS Worm Sigs, John Nagro
    - Re: Unknown IIS Worm Sigs, John Nagro
    - Re: Unknown IIS Worm Sigs, John Nagro
    - Re: Unknown IIS Worm Sigs, Matthew Jonkman
- Re: Unknown IIS Worm Sigs, Brian
  - Re: Unknown IIS Worm Sigs, John Nagro
    - Re: Unknown IIS Worm Sigs, nnposter
  - Re: Unknown IIS Worm Sigs, Matthew Jonkman
    - Re: Unknown IIS Worm Sigs, Brian
    - Re: Unknown IIS Worm Sigs, Matthew Jonkman
- RE: Unknown IIS Worm Sigs, Wesley Young
- Re: Unknown IIS Worm Sigs, Matthew Jonkman
False positive for P2P GNUTella client request (1432), Randy Bradley
- Re: False positive for P2P GNUTella client request (1432), Mike Adams
- Re: False positive for P2P GNUTella client request (1432), Nigel Houghton
false positive sid:1917, Top, Jonathan
Some rules I used, Chich Thierry
Is modifier depth:32 required in the sid rule no. 1102, Kumar,Rajesh
- Re: Is modifier depth:32 required in the sid rule no. 1102, tony
Newbie knucklehead can't get a custom rule to alert, tony
- Re: Newbie knucklehead can't get a custom rule to alert, Matthew Watchinski
  - Re: Newbie knucklehead can't get a custom rule to alert, tony
    - Re: Newbie knucklehead can't get a custom rule to alert, Nigel Houghton
    - Re: Newbie knucklehead can't get a custom rule to alert, tony
    - Re: Newbie knucklehead can't get a custom rule to alert, Nigel Houghton
Invalid HTTP still giving lots of FP's, Kevin Peuhkurinen
- Re: Invalid HTTP still giving lots of FP's, Nigel Houghton
SID 2404, NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt, Lance Boon
- Re: SID 2404, NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt, Nigel Houghton
False +ves: SID 2517 Message IMAP PCT Client_Hello overflow attempt, Russell Fulton
- Re: False +ves: SID 2517 Message IMAP PCT Client_Hello overflow attempt, Nigel Houghton
False +ves on FTP shadow retrieval attempt and suggested mitigation strategy, Russell Fulton
- Re: False +ves on FTP shadow retrieval attempt and suggested mitigation strategy, Nigel Houghton
- RE: False +ves on FTP shadow retrieval attempt and suggested mitigation strategy, Murat Korkmaz
  - Re: False +ves on FTP shadow retrieval attempt and suggested mitigation strategy, Nigel Houghton
Alerts lacking signature names, David R. Waddell
- Alerts lacking signature names, David R. Waddell
- Alerts lacking signature names, David R. Waddell
- Alerts lacking signature names, David R. Waddell
Portscans.... How to?, Pedro Jorge Barradas
AW: signature doesn't match, Lutz Schildt
Virus Outbound Attachment rule, Matthew Jonkman
payload problem, Alexandru Balan
- Re: payload problem, Michael Boman
Virus / worm detection rules, Dan Metcalf
signature doesn't match, Alexandru Balan
- RE: signature doesn't match, Joshua Berry
  - RE: signature doesn't match, Alexandru Balan
  - RE: signature doesn't match, Alexandru Balan
- RE: signature doesn't match, Joshua Berry
Virus/Worms signatures ruleset, Dan Metcalf
- Re: Virus/Worms signatures ruleset, Matthew Jonkman
  - Re: Virus/Worms signatures ruleset, Jason Haar
    - Re: Virus/Worms signatures ruleset, Matthew Jonkman
- Re: Virus/Worms signatures ruleset, Xram_LraK
- Re: Virus/Worms signatures ruleset, Mark
  - Re: Re: Virus/Worms signatures ruleset, Brian
Multiple Keyword Sig, is it possible?, Jeffrey Lowe
- Re: Multiple Keyword Sig, is it possible?, Erik de Castro Lopo
snort-rules 2.1.* update @ Wed Jun 16 20:15:36 2004, bmc
snort-rules CURRENT update @ Wed Jun 16 20:15:36 2004, bmc
what means flowbits in signatures, Ali Zand
- Re: what means flowbits in signatures, Brian
- RE: what means flowbits in signatures, Kreimendahl, Chad J
RE: Weird new CMD.EXE payload..., Larry Pingree
- RE: Weird new CMD.EXE payload..., Paul Schmehl
Holy false Positives, Goodson, Jacob
- Re: Holy false Positives, Shaun T. Erickson
  - Weird new CMD.EXE payload..., K. Jared Kalisz
    - Re: Weird new CMD.EXE payload..., Roach4
    - RE: Weird new CMD.EXE payload..., K. Jared Kalisz
    - Re: Weird new CMD.EXE payload..., Nigel Houghton
  - Re: Holy false Positives, Matthew Watchinski
    - Re: Holy false Positives, Shaun T. Erickson
- Re: Holy false Positives, sekure
- Re: Holy false Positives, Joe Matusiewicz
- RE: Holy false Positives, VanBrecht, Jason
Holy False Positives Batman, Matthew Jonkman
- Re: Holy False Positives Batman, Jeff Kell
- Re: Holy False Positives Batman, Matthew Jonkman
  - Re: Re: Holy False Positives Batman, Brian
    - Re: Re: Holy False Positives Batman, John J. Nagro
    - Re: Re: Holy False Positives Batman, Brian
- Re: Holy False Positives Batman, Brian
signature: Squid NTLM Auth Overflow Exploit, Aaron W. DeLashmutt
snort-rules 2.1.* update @ Tue Jun 15 14:15:33 2004, bmc
snort-rules CURRENT update @ Tue Jun 15 14:15:33 2004, bmc
Erkez Virus Sig, Tony Bunce
Re: Rules to detect recent Serv-u vulnerabilities, Javier Fernandez-Sanguino
- Re: Rules to detect recent Serv-u vulnerabilities, Brian
  - Re: Rules to detect recent Serv-u vulnerabilities, Javier Fernandez-Sanguino
  - Re: Rules to detect recent Serv-u vulnerabilities, Javier Fernandez-Sanguino
    - Re: Rules to detect recent Serv-u vulnerabilities, Brian
Re: False positives for 1748, Javier Fernandez-Sanguino
- Re: False positives for 1748, Nigel Houghton
Duplicate Sids, Mark
WEB-CLIENT IE local resource invocation attempt, nnposter
Bleeding Rules Addition, Matthew Jonkman
SID 2405: WEB-PHP phptest.php access, Maarten Van Horenbeeck
False positive?, Steve Moran
SID 2407: WEB-MISC util.pl access, Maarten Van Horenbeeck
- Re: SID 2407: WEB-MISC util.pl access, Matthew Watchinski
report of false positives for "SCAN UPnP service discover attempt" rule, Daniel Surdu
- Re: report of false positives for "SCAN UPnP service discover attempt" rule, Nigel Houghton
Suspected false +ve., Mark Rainer
Signature Dates, Murat Korkmaz
- Re: Signature Dates, Nigel Houghton
- RE: Signature Dates, Ayesha Khan
GotoMyPC Sig, Matthew Jonkman
POP2 commands case-sensitive?, nnposter
Reference for 1985.1 (BACKDOOR Doly 1.5 server response)?, nnposter
False positives on 1321.8 (BAD-TRAFFIC 0 ttl), nnposter
Signature release process, Lon
- Re: Signature release process, Brian
  - Re: Signature release process, Lon
    - Re: Signature release process, Brian
False positives on 2050.3 (MS-SQL version overflow attempt), nnposter
Corrupted definitions of 2403.4 and 2404.5?, nnposter
- Re: Corrupted definitions of 2403.4 and 2404.5?, Brian
- Corrupted definitions of 2403.4 and 2404.5?, nnposter
sig for korgo worm, Lin Zhong
Sig for Korgo and Plexus, Lin Zhong
Re: Snort-sigs digest, Vol 1 #954 - 8 msgs, Ross . Emma
RE: WEB-FRONTPAGE /_vti_bin/ access rule question to the community, Coen Bakkers, Monitored Security
Possible trojan rule, Matthew Jonkman
- Re: Possible trojan rule, Matthew Jonkman
- Re: Possible trojan rule, Hugo van der Kooij
  - Re: Possible trojan rule, Micheal Cottingham
    - Re: Possible trojan rule, Joe Stewart
    - Re: Possible trojan rule, Matthew Jonkman
  - Re: Possible trojan rule, Matthew Jonkman
- RE: Possible trojan rule, Stark, Vernon L.
  - Re: Possible trojan rule, Matthew Jonkman
- RE: Possible trojan rule, larosa, vjay
  - Re: Possible trojan rule, Matthew Jonkman
- RE: Possible trojan rule, Stark, Vernon L.
  - Re: Possible trojan rule, Matthew Jonkman
- RE: Possible trojan rule, larosa, vjay
Call for help, Matthew Jonkman
- Documentation question SID 1411 - 1414, Michael Sconzo
  - Re: Documentation question SID 1411 - 1414, Nigel Houghton
Is correct this alert? "NETBIOS SMB IPC$ share unicode access", lee Jerry
- Re: Is correct this alert? "NETBIOS SMB IPC$ share unicode access", lee Jerry
Windows RPC Interface access detect signature set (win-rpc.rules), kawa
- Re: Windows RPC Interface access detect signature set (win-rpc.rules), Matthew Jonkman
- RE: Windows RPC Interface access detect signature set (win-rpc.rules), Kreimendahl, Chad J
  - Re: Windows RPC Interface access detect signature set (win-rpc.rules), Matthew Jonkman
- RE: Windows RPC Interface access detect signature set (win-rpc.rules), Kreimendahl, Chad J
  - Re: Windows RPC Interface access detect signature set (win-rpc.rules), Matthew Jonkman
Duplicates, Matthew Jonkman
- RE: Duplicates, Doug Small
NETBIOS nimda .eml, McCash, John
- Re: NETBIOS nimda .eml, Jason Haar
SID: 2329 - probable false positive, Domain Admin
- Re: SID: 2329 - probable false positive, Matthew Watchinski
Re: gen_id in suppress and threshold rules, Chris Keladis
False Positive: http://www.snort.org/snort-db/sid.html?sid=1360, Colin Harford
False positive for 230 - DDOS shaft client to handler, Jens-Harald . Johansen