security.ids.snort.sigs (thread)

FP on BLEEDING-EDGE Pwdump3e Password Hash Retrieval, Matt Ostiguy
sig for backdoor.krei, Graeme Rider
FPs with SID:2587 "P2P eDonkey transfer", Jason Haar
What is the & operator in byte_test for?, Joseph Gama
- Re: What is the & operator in byte_test for?, Keith W. McCammon
  - RE: What is the & operator in byte_test for?, Jeff Dell
    - Thank you!, Joseph Gama
- RE: What is the & operator in byte_test for?, Jeff Dell
  - Re: What is the & operator in byte_test for?, Keith W. McCammon
  - Thank you!, Joseph Gama
- Re: What is the & operator in byte_test for?, Matt Kettler
http_inspect, Esler, Joel - Contractor
Colin Slevin/TRANSWARE/IE is out of the office., Colin . Slevin
JoltID, Matthew Jonkman
Rule #2000900, Ole-Martin
- Re: Rule #2000900, Matthew Jonkman
  - Re: Rule #2000900, Ole-Martin
    - Re: Rule #2000900, Matthew Jonkman
suggestion, Joseph Gama
Mydoom.M signatures, Roach4
- Re: Mydoom.M signatures, Keith W. McCammon
  - Re: Mydoom.M signatures, Keith W. McCammon
- Re: Mydoom.M signatures, Hugo van der Kooij
Parasite Rules, Matthew Jonkman
pcre fails when using ; or (, Joseph Gama
sigs with asn1 fails, Rocio Alfonso Pita
- Re: sigs with asn1 fails, Jason
- Re: sigs with asn1 fails, Brian
  - Re: sigs with asn1 fails, Keith A. Pachulski
  - Re: sigs with asn1 fails, Matthew Jonkman
- RE: sigs with asn1 fails, Joshua Berry
  - Re: sigs with asn1 fails, Brian
    - Re: sigs with asn1 fails, Keith A. Pachulski
    - RE: sigs with asn1 fails, Eric Hines
  - RE: sigs with asn1 fails, Eric Hines
IMPORTANT BLEEDING SNORT UPDATE!!, Matthew Jonkman
Parasite malware set, Matthew Jonkman
rule 1667 should be replaced, Joseph Gama
Sdbot and Spybot Worm sigs?, Raj Wurttemberg
- Re: Sdbot and Spybot Worm sigs?, Keith W. McCammon
More false negatives for 716.10 (TELNET access), nnposter
asn1 rules FP?, Nerijus Krukauskas
rule 1497 should be fixed, Joseph Gama
- RE: rule 1497 should be fixed, Shomiron Das Gupta [NetMonastery]
  - RE: rule 1497 should be fixed, Joseph Gama
Sid 1328 and 1329, Joshua Berry
- RE: Sid 1328 and 1329, Shomiron Das Gupta [NetMonastery]
- RE: Sid 1328 and 1329, Joshua Berry
Tagged Packet?, Rowland, Krisa W ERDC-ITL-MS Contractor
- Re: Tagged Packet?, Jason Alexander
  - Re: Tagged Packet?, Daniel Roelker
- Re: Tagged Packet?, Jason
- RE: Tagged Packet?, Esler, Joel - Contractor
huge number of false positives for WEB-MISC SSLv3 invalid Client_Hello attempt?, Matt Ostiguy
- Re: huge number of false positives for WEB-MISC SSLv3 invalid Client_Hello attempt?, Matthew Watchinski
  - Re: Re: huge number of false positives for WEB-MISC SSLv3 invalid Client_Hello attempt?, Matt Ostiguy
    - Re: huge number of false positives for WEB-MISC SSLv3 invalid Client_Hello attempt?, Matthew Watchinski
New Malware/Spyware rules, Matthew Jonkman
- Re: New Malware/Spyware rules, Jason Haar
  - Re: New Malware/Spyware rules, Matthew Jonkman
More Malware rules, Matthew Jonkman
Some adware fun, Matthew Jonkman
False positives in rule 1113, Federico Petronio
rule to catch "Bargain Buddy" downloads, Miner, Jonathan W (CSC) (US SSA)
- Re: rule to catch "Bargain Buddy" downloads, Matthew Jonkman
Why not to use flags:AP, Matthew Watchinski
Bypassing rules with spaces in scripts, Joseph Gama
AOL Webmail rules, Matthew Jonkman
Re: Snort-sigs digest, Vol 1 #1022 - 9 msgs, Todd Smith
RE: a few more rules FALSE POS, Adrian Marsden
- RE: a few more rules FALSE POS - fixed, Joseph Gama
- RE: a few more rules FALSE POS, Joseph Gama
sid:2578 sid 2579, Mark
new rules for Kcast ticker, Miner, Jonathan W (CSC) (US SSA)
- Re: new rules for Kcast ticker, Matthew Jonkman
Traffic parsing order, Cluett, Russell
- Re: Traffic parsing order, Matthew Watchinski
more scan rules, Joseph Gama
VECNA scan rules, Joseph Gama
rules to detect possible threats by the dll's called, Invalid fragment+TCP flags, Adobe Acrobat Reader XFDF possible buffer overflow, Joseph Gama
- Re: rules to detect possible threats by the dll's called, Invalid fragment+TCP flags, Adobe Acrobat Reader XFDF possible buffer overflow, Matthew Jonkman
  - Re: rules to detect possible threats by the dll's called, Invalid fragment+TCP flags, Adobe Acrobat Reader XFDF possible buffer overflow, Joseph Gama
    - Re: rules to detect possible threats by the dll's called, Invalid fragment+TCP flags, Adobe Acrobat Reader XFDF possible buffer overflow, Judy Novak
Remote Anything Sig, Jason Alexander
- Re: Remote Anything Sig, Joseph Gama
pwdump, l0phtcrack, hash extraction, Matt Sheridan
- Re: pwdump, l0phtcrack, hash extraction, Brian
- Re: pwdump, l0phtcrack, hash extraction, Matthew Jonkman
- RE: pwdump, l0phtcrack, hash extraction, Kreimendahl, Chad J
  - Re: pwdump, l0phtcrack, hash extraction, Matthew Jonkman
- Re: pwdump, l0phtcrack, hash extraction, Matt Sheridan
- RE: pwdump, l0phtcrack, hash extraction, Matt Sheridan
  - Re: pwdump, l0phtcrack, hash extraction, Matthew Jonkman
ipcop-13 "virus.rules" maintainance, Ivan Parker
- RE: ipcop-13 "virus.rules" maintainance, Corey Rock
rules in tgz format, no docs, Joseph Gama
Excluding the snort host from all rules?, R S
- Re: Excluding the snort host from all rules?, Matthew Watchinski
  - Re: Excluding the snort host from all rules?, Keith W. McCammon
- RE: Excluding the snort host from all rules?, Harper, Patrick
False Positive - ATTACK-RESPONSES id check returned userid, Gary Verhulp
Sig #, Ron WILSON
a few more rules, Joseph Gama
Rules to detect netbios unauthorized access, Joseph Gama
Suspicious File Extensions, Matthew Jonkman
- Re: Suspicious File Extensions, Joe Flowers
  - Re: Suspicious File Extensions, Matthew Jonkman
    - RE: Suspicious File Extensions, Herb Martin
    - Re: Suspicious File Extensions, Matthew Jonkman
- Re: Suspicious File Extensions, Jason
do you know what is it ?, Erik Lalancette
- Re: do you know what is it ?, sekure
- Re: do you know what is it ?, Roach4
- RE: do you know what is it ?, Harper, Patrick
- RE: do you know what is it ?, Harper, Patrick
- RE: do you know what is it ?, Erik Lalancette
PHP-Nuke SQL injection rule, Federico Petronio
- PHP-Nuke SQL injection rule, Federico Petronio
Unknown IIS Issue, Matthew Jonkman
- Re: Unknown IIS Issue, Matthew Watchinski
  - Re: Unknown IIS Issue, Matthew Jonkman
    - Re: Unknown IIS Issue, Frank Knobbe
    - Re: Unknown IIS Issue, Matthew Jonkman
    - Re: Unknown IIS Issue, Frank Knobbe
    - Re: Unknown IIS Issue, Matthew Jonkman
Interesting false positive for HTTP_Connect, Matthew Jonkman
- Re: Interesting false positive for HTTP_Connect, Jason
  - Re: Interesting false positive for HTTP_Connect, Matthew Jonkman
  - Re: Interesting false positive for HTTP_Connect, Matthew Jonkman
    - Re: Interesting false positive for HTTP_Connect, Jason
    - Re: Interesting false positive for HTTP_Connect, Jason
    - Re: Interesting false positive for HTTP_Connect, Matthew Jonkman
    - Re: Interesting false positive for HTTP_Connect, Matthew Jonkman
    - Re: Interesting false positive for HTTP_Connect, Jason
    - Re: Interesting false positive for HTTP_Connect, Matthew Jonkman
Russian Ebay scam rule, Matthew Jonkman
Comet Cursor Spyware, Matthew Jonkman
snort-rules CURRENT update @ Fri Jul 16 16:15:40 2004, bmc
HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
- Re: HTTP Tunneling, Matthew Jonkman
- RE: HTTP Tunneling, Joshua Berry
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
  - Re: HTTP Tunneling, sekure
    - Re: HTTP Tunneling, Matthew Jonkman
- RE: HTTP Tunneling, Joshua Berry
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
- RE: HTTP Tunneling, Schmehl, Paul L
  - RE: HTTP Tunneling, Chris Kronberg
- RE: HTTP Tunneling, Barnes Brandon A1C AFWA/SCHS
BLEEDING-EDGE IE spyware downloader get.php, Matthew Jonkman
New rules, Joseph Gama
- Re: New rules, Matthew Jonkman
SMS dos rule, Johnathan Norman
Does anyone know how to check the urgent pointer (not the URG flag)?, Joseph Gama
- Re: Does anyone know how to check the urgent pointer (not the URG flag)?, Matthew Watchinski
Netbios Domain Name Sig, Jason Linden
- Re: Netbios Domain Name Sig, nnposter
- Re: Netbios Domain Name Sig, Ron Jackson
- RE: Netbios Domain Name Sig, Jason Linden
  - RE: Netbios Domain Name Sig, Tim Otis
  - RE: Netbios Domain Name Sig, Joseph Gama
- Re: Netbios Domain Name Sig, Ron Jackson
question about sid:2570, Miner, Jonathan W (CSC) (US SSA)
- Re: question about sid:2570, Brian
- Re: question about sid:2570, Jason
- Re: question about sid:2570, Richard Ullrich
Atak Rule, Matthew Jonkman
Invalid TCP packet, header length<20 bytes, Joseph Gama
- Re: Invalid TCP packet, header length<20 bytes, Chris Reining
Denial of Service (DoS) in Microsoft SMS Client Signature, Terence Runge
Rules for MS-SQL, Joseph Gama
mysql.php3 [snort with MySQL], drigattieri
sig 528 false positive, Dan Heideman
- Re: sig 528 false positive, Matthew Watchinski
major problems with 2.1 snapshot rules?, Eric Bowser
False positive on rule SID 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt, Joseph Gama
- Re: False positive on rule SID 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt, Nigel Houghton
probable false positive (NOT attack information; this is a "possible bug" report), Gabriel Maybrun
SNORT false positives, Scott Elgram
Rule 2101 FP's..., Tobias Rice
- Re: Rule 2101 FP's..., Nigel Houghton
False positive/negative, Rasmus Carstensen
False positive C$ - signatures 2470, 2472, 2471 and 533, erik
- Re: False positive C$ - signatures 2470, 2472, 2471 and 533, Brian
- Re: False positive C$ - signatures 2470, 2472, 2471 and 533, sekure
  - Re: False positive C$ - signatures 2470, 2472, 2471 and 533, Matthew Watchinski
    - Re: Re: False positive C$ - signatures 2470, 2472, 2471 and 533, sekure
How to reapply a sig on packets in a same session, Chich Thierry
- Re: How to reapply a sig on packets in a same session, Matthew Watchinski
False positive, Antonio Henrique A. P. Oliveira
RE: Unknown IIS Worm Sigs, Hoover, James A (EIS, Corp)
- RE: Unknown IIS Worm Sigs, Hoover, James A (EIS, Corp)
MS04-021.mspx, Murat Korkmaz
New MS_SQL Rules, Matthew Jonkman
HTTP_PORTS Question, Matthew Jonkman
- Re: HTTP_PORTS Question, Matthew Jonkman
  - Re: HTTP_PORTS Question, Brian
- Re: HTTP_PORTS Question, sekure
  - Re: HTTP_PORTS Question, Matthew Jonkman
  - Re: HTTP_PORTS Question, Matthew Jonkman
where i cant find, Erik Lalancette
- Re: where i cant find, Matthew Jonkman
- Re: where i cant find, Matt Kettler
- RE: where i cant find, Erik Lalancette
Shell code Rules 653 and 2314, Scott Zawalski
- Re: Shell code Rules 653 and 2314, Brian
Disabling 2 rules, Matthew Jonkman
- Re: Disabling 2 rules, Matthew Jonkman
  - RE: Disabling 2 rules, Eric Hines
  - RE: Disabling 2 rules, Eric Hines
BLEEDING-EDGE MS-SQL SQL Injection allowing empty or wrong input with an OR, Matthew Jonkman
detect most binary file formats, Joseph Gama
- Re: detect most binary file formats, Matthew Jonkman
  - Re: detect most binary file formats, Jason Haar
    - Re: detect most binary file formats, Matthew Jonkman
Great new MS SQL Rules, Matthew Jonkman
Re: Workstations trying to GET /download/IEService215.chm HTTP/1.1 from 67.109.249.3, Matthew Jonkman
Improved code to create the relationships in MS-SQL, Joseph Gama
false positive for SID 2123, Joseph Gama
Bug found when using "output database: log, mssql" in snort.conf, Joseph Gama
New gator sig, Matthew Jonkman
rule revision tracking, John Nagro
- Re: rule revision tracking, Matthew Watchinski
  - Re: rule revision tracking, John Nagro
    - Re: rule revision tracking, John Nagro
- Re: rule revision tracking, Matt Kettler
- RE: rule revision tracking, Joshua Berry
Gain/Gator spyware sig, Esler, Joel - Contractor
Uricontent issue, Matthew Jonkman
- RE: Uricontent issue, Kreimendahl, Chad J
  - Re: Uricontent issue, Matthew Jonkman
  - Re: Uricontent issue, Matthew Jonkman
- RE: Uricontent issue, Miner, Jonathan W (CSC) (US SSA)
  - Re: Uricontent issue, Matthew Jonkman
Scob Updates, Matthew Jonkman
Rules to get the first 3 bytes from a UDP packet fail, Joseph Gama
- Re: Rules to get the first 3 bytes from a UDP packet fail, Matthew Watchinski
PHILIP LJUNGBERG heeft verlof., philip . ljungberg
Rules for ject and scob worms, Joseph Gama
- Re: Rules for ject and scob worms, Matthew Jonkman
New submissions, Matthew Jonkman
RE: snort rules and -CURRENT for 2.1.3, Rowland, Krisa W ERDC-ITL-MS Contractor
- Re: snort rules and -CURRENT for 2.1.3, Eric Jacobsen
  - Re: snort rules and -CURRENT for 2.1.3, Xram_LraK
- RE: snort rules and -CURRENT for 2.1.3, Rowland, Krisa W ERDC-ITL-MS Contractor
BIttorrent Signature updates, Matthew Jonkman
- Re: BIttorrent Signature updates, Nigel Houghton
  - Re: BIttorrent Signature updates, Matthew Jonkman
    - Re: BIttorrent Signature updates, Nigel Houghton
    - Re: BIttorrent Signature updates, Matthew Jonkman
    - Re: BIttorrent Signature updates, Nigel Houghton
  - Re: BIttorrent Signature updates, Chich Thierry
    - Re: BIttorrent Signature updates, Matthew Jonkman
    - Re: BIttorrent Signature updates, Chich Thierry
    - Re: BIttorrent Signature updates, Matthew Jonkman
    - Re: BIttorrent Signature updates, Matthew Jonkman
- Re: BIttorrent Signature updates, Matthew Watchinski
  - Re: BIttorrent Signature updates, Matthew Jonkman
Re: Is modifier depth:32 required in the sid rule no. 1102, Matthew Watchinski
Maleware Keenvalue, Matthew Jonkman
Improved code for creating the data structure in MS-SQL 2000, Joseph Gama
False positive NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt, Joseph Gama
- Re: False positive NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt, Brian
How to filter by only the first 3 bytes of data?, Joseph Gama
- Re: How to filter by only the first 3 bytes of data?, Brian
[Fwd: Proposed change to the Virus Rule], Matthew Jonkman
- RE: [Fwd: Proposed change to the Virus Rule], nnposter
- Re: [Fwd: Proposed change to the Virus Rule], Brian
  - Re: [Fwd: Proposed change to the Virus Rule], Matthew Jonkman
Bug in 1934.6? (POP2 FOLD overflow attempt), nnposter
- Re: Bug in 1934.6? (POP2 FOLD overflow attempt), Brian
New bleeding sigs, Matthew Jonkman
- Re: New bleeding sigs, Kevin Kolk
  - Re: New bleeding sigs, Matthew Jonkman
    - Re: New bleeding sigs, Matthew Jonkman
Avoidance of 663.13 (SMTP rcpt to command attempt), nnposter
Avoidance of 2270.4 (SMTP RCPT TO sendmail prescan too long addresses overflow), nnposter
Re: POP2 commands case-sensitive?, Brian
Re: Poor detection rate by 1:716:6 (TELNET access), Brian
Re: False negatives on 1:491:6 (INFO FTP Bad login), Brian
Re: Avoidance of 1:1970:1 (WEB-IIS MDAC Content-Type overflow attempt), Brian
Re: Signature contributions, Brian
Further tweaks for the Evaman rule, Matthew Jonkman
Evaman Worm Sig, Matthew Jonkman
Evaman Worm Outbound BLEEDINGSNORT, James Ashton
Proposed change to the Virus Rule, Matthew Jonkman
Avoidance of 664.13 (SMTP RCPT TO decode attempt), nnposter
- Re: Avoidance of 664.13 (SMTP RCPT TO decode attempt), Brian
Bug in 654.13 (SMTP RCPT TO overflow), nnposter
- Re: Bug in 654.13 (SMTP RCPT TO overflow), Brian
Avoidance of 2278.6 (WEB-MISC negative Content-Length attempt), nnposter
- Re: Avoidance of 2278.6 (WEB-MISC negative Content-Length attempt), Brian
Avoidance of 2230.5 (WEB-MISC NetGear router default password login attempt admin/password), nnposter
- Re: Avoidance of 2230.5 (WEB-MISC NetGear router default password login attempt admin/password), Matthew Jonkman
- Re: Avoidance of 2230.5 (WEB-MISC NetGear router default password login attempt admin/password), Brian
Avoidance of 1861.7 (WEB-MISC Linksys router default username and password login attempt), nnposter
- Re: Avoidance of 1861.7 (WEB-MISC Linksys router default username and password login attempt), Brian
False positives on 1807.9 (WEB-MISC Chunked-Encoding transfer attempt), nnposter
- Re: False positives on 1807.9 (WEB-MISC Chunked-Encoding transfer attempt), Brian
False positives on 1806.7 (WEB-IIS .htr chunked Transfer-Encoding), nnposter
- Re: False positives on 1806.7 (WEB-IIS .htr chunked Transfer-Encoding), Brian
False positives on 1618.14 (WEB-IIS .asp chunked Transfer-Encoding), nnposter
- Re: False positives on 1618.14 (WEB-IIS .asp chunked Transfer-Encoding), Brian
Avoidance of 1260.10 (WEB-MISC long basic authorization string), nnposter
- Re: Avoidance of 1260.10 (WEB-MISC long basic authorization string), Brian
  - Re: Avoidance of 1260.10 (WEB-MISC long basic authorization string), nnposter
Avoidance of 2183.5 (SMTP Content-Transfer-Encoding overflow attempt), nnposter
- Re: Avoidance of 2183.5 (SMTP Content-Transfer-Encoding overflow attempt), Brian
  - Re: Avoidance of 2183.5 (SMTP Content-Transfer-Encoding overflow attempt), nnposter
- Re: Avoidance of 2183.5 (SMTP Content-Transfer-Encoding overflow attempt), Brian
Avoidance of 2437.5 (WEB-CLIENT RealPlayer arbitrary javascript command attempt), nnposter
- Re: Avoidance of 2437.5 (WEB-CLIENT RealPlayer arbitrary javascript command attempt), Brian
Avoidance of 1992.5 (FTP LIST directory traversal attempt), nnposter
- Re: Avoidance of 1992.5 (FTP LIST directory traversal attempt), Brian
Avoidance of 1860.4 (WEB-MISC Linksys router default password login attempt), nnposter
- Re: Avoidance of 1860.4 (WEB-MISC Linksys router default password login attempt), Brian
Avoidance of 1817.4 (WEB-IIS MS Site Server default login attempt), nnposter
- Re: Avoidance of 1817.4 (WEB-IIS MS Site Server default login attempt), Brian
Avoidance of 1672.10 (FTP CWD ~ attempt), nnposter
- Re: Avoidance of 1672.10 (FTP CWD ~ attempt), Brian
Squid NTML Auth overflow sig, Matthew Jonkman
Yahoo mail updates, Matthew Jonkman
- Re: Yahoo mail updates, Matthew Watchinski
  - Re: Yahoo mail updates, Matthew Jonkman
- RE: Yahoo mail updates, Adrian Marsden
  - Re: Yahoo mail updates, Matthew Jonkman
False positive for 2461, Matthew Jonkman
False positive for 2460, Matthew Jonkman
Sid:2113 FP, sekure
- Re: Sid:2113 FP, Matthew Watchinski