security.ids.snort.sigs (thread)

SAM tool, Paul Ryan
- Re: SAM tool, John Nagro
secure connection to bleedingsnort.com, John Nagro
- Re: secure connection to bleedingsnort.com, John Nagro
- Re: secure connection to bleedingsnort.com, John Nagro
- RE: secure connection to bleedingsnort.com, Esler, Joel - Contractor
Akak trojan signatures, Joe Stewart
Add false positive entry to rule 1:2003, Lyndon Tiu
snort-rules update @ Fri Aug 27 15:15:43 2004, bmc
" ..MS Terminal Server no encryption.. " misfire?, Ben Dugdale
- Re: " ..MS Terminal Server no encryption.. " misfire?, Nigel Houghton
Snorting gzip encoded http source code, Abe Use
- RE: Snorting gzip encoded http source code, Abe Use
- RE: Snorting gzip encoded http source code, Abe Use
  - Re: Snorting gzip encoded http source code, Jason Haar
    - Re: Snorting gzip encoded http source code, Jose Maria Lopez
BACKDOOR NetMetro File List Signature False Positive, McCash, John
- Re: BACKDOOR NetMetro File List Signature False Positive, Nigel Houghton
Possible false positives for rule 1:1983, 1:1980 and 1:1981, George Laiacona
- Re: Possible false positives for rule 1:1983, 1:1980 and 1:1981, Alex Kirk
snort-rules update @ Thu Aug 26 11:15:39 2004, bmc
2383 FP " NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt", sekure
- Re: 2383 FP " NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt", Alex Kirk
  - Re: Re: 2383 FP " NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt", sekure
    - Re: 2383 FP " NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt", Alex Kirk
bleedingsnort PNG rule 2001203 FP?, Federico Petronio
- Re: bleedingsnort PNG rule 2001203 FP?, Federico Petronio
Malware/Spyware, Matthew Jonkman
- Re: Malware/Spyware, Stef
SSH Scans, Matthew Jonkman
- Re: SSH Scans, Brian
  - Re: SSH Scans, Matthew Jonkman
- Re: SSH Scans, Frank Knobbe
  - Re: SSH Scans, Matthew Jonkman
    - Re: SSH Scans, Ben Whaley
    - Re: SSH Scans, Frank Knobbe
    - Re: SSH Scans, Matthew Jonkman
sid 2518 typo?, Aaron W. DeLashmutt
- Re: sid 2518 typo?, Brian
SID 1344, James Ashton
- Re: SID 1344, Nigel Houghton
- RE: SID 1344, James Ashton
  - Re: SID 1344, Nigel Houghton
David Kibilka/Networking/Willich/Datasystems ist außer Haus., dkibilka
SID 2417, Paul Schmehl
- Re: SID 2417, Nigel Houghton
- Re: SID 2417, Frank Knobbe
- RE: SID 2417, Murat Korkmaz
  - RE: SID 2417, Paul Schmehl
BleedingSnort rules hits information, Federico Petronio
- Re: BleedingSnort rules hits information, Matthew Jonkman
Snort Rule Howto, Andrews Carl 448
- Re: Snort Rule Howto, twebster
- RE: Snort Rule Howto, John Hally
- RE: Snort Rule Howto, Andrews Carl 448
- RE: Snort Rule Howto, Andrews Carl 448
  - Re: RE: Snort Rule Howto, James Riden
    - Connecting signatures?, Chris Kronberg
    - Re: Connecting signatures?, Keith W. McCammon
    - Re: Connecting signatures?, Chris Kronberg
    - Re: Connecting signatures?, Matthew Watchinski
    - Re: Connecting signatures?, Erik Fichtner
    - Re: Connecting signatures?, Chris Kronberg
- RE: RE: Snort Rule Howto, Harper, Patrick
- RE: RE: Snort Rule Howto, Andrews Carl 448
Possible False Positive on SID 2383, Lance Boon
- Re: Possible False Positive on SID 2383, Nigel Houghton
Rule 466 False-Positives, John B.
DHCP Attack, arif . jatmoko
- Re: DHCP Attack, Kenneth G. Arnold
  - Re: DHCP Attack, arif . jatmoko
  - Re: DHCP Attack, Nick Hatch
    - Re: DHCP Attack, Kenneth G. Arnold
    - Re: DHCP Attack, twebster
    - Re: DHCP Attack, Frank Knobbe
- Re: DHCP Attack, Chris Reining
PNG vulnerabilities and more, Joseph Gama
- Re: PNG vulnerabilities and more, Joe Stewart
  - Re: PNG vulnerabilities and more, Joseph Gama
    - Re: PNG vulnerabilities and more, Joe Stewart
Serv-U vulnerabilities, Joseph Gama
Mozilla vulnerabilities, Joseph Gama
Snort rules question., wbenetti
- Re: Snort rules question., Matt Kettler
New adobe vulnerability, Matthew Jonkman
- Re: New adobe vulnerability, Joseph Gama
  - Re: New adobe vulnerability, Frank Knobbe
    - Re: New adobe vulnerability, nnposter
    - Re: New adobe vulnerability, Frank Knobbe
    - Re: New adobe vulnerability, Matthew Watchinski
    - Re: New adobe vulnerability, Frank Knobbe
    - Re: New adobe vulnerability, frank
    - Re: New adobe vulnerability, Frank Knobbe
- RE: New adobe vulnerability, nnposter
  - Re: New adobe vulnerability, Matthew Jonkman
Call for Spyware, Matthew Jonkman
Update on the non-smtp server rule, Eric Hines
- Re: Update on the non-smtp server rule, Matthew Jonkman
snort-rules 2.1.* update @ Tue Aug 10 10:15:41 2004, bmc
snort-rules CURRENT update @ Tue Aug 10 10:02:57 2004, bmc
- SID 2492 - Question, Michael Sconzo
help, randy gillo
- Re: help, Alex Kirk
- Re: help, Joseph Gama
More Bagle.AQ rules, Matthew Jonkman
NIDS Signature # 1930: False positive, Bob Van Cleef
New bagle variant, Matthew Jonkman
amendment to ATTACK-RESOPNSES id check returned root, Likai Liu
(no subject), Gary Verhulp
SID 1432 False Positive (P2P GNUTella client request), lonewf
Rules sid:2000344 and following (IRC)., Chich Thierry
- Re: Rules sid:2000344 and following (IRC)., Matthew Jonkman
  - Re: Rules sid:2000344 and following (IRC)., Chich Thierry
    - Re: Rules sid:2000344 and following (IRC)., Matthew Jonkman
PNG vulnerabilities 1, Joseph Gama
IE exploits, Joseph Gama
Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- RE: Bleedingsnort.com Daily Update, Graeme Rider
  - Re: Bleedingsnort.com Daily Update, Alex Kirk
  - Re: Bleedingsnort.com Daily Update, Matthew Jonkman
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
  - Re: Bleedingsnort.com Daily Update, Jose Maria Lopez
lsasrv.dll exploit, Albers, Lucas
- Re: lsasrv.dll exploit, Matthew Jonkman
signature for SoulSeek P2P?, twebster
- Re: signature for SoulSeek P2P?, Matthew Jonkman
  - Re: signature for SoulSeek P2P?, John Nagro
- Re: signature for SoulSeek P2P?, Alex Kirk
- RE: signature for SoulSeek P2P?, marcamone
  - RE: signature for SoulSeek P2P?, twebster
  - Re: signature for SoulSeek P2P?, Alex Kirk
    - Re: signature for SoulSeek P2P?, Matthew Jonkman
Signatures for the latest rxbot / rbot variant, Christopher Harrington
I must have signed up for the wrong mailing list, Daniel Gutzwiller
- Re: I must have signed up for the wrong mailing list, Hugo van der Kooij
  - Re: I must have signed up for the wrong mailing list, webcatalog
new rules 9, Joseph Gama
RE: [Snort-sigs]sorry, Harper, Patrick
False positive in sid:1448, Federico Petronio
- Re: False positive in sid:1448, Nigel Houghton
Another idea for the preprocessor, Joseph Gama
encoded Javascript not being detected, Joseph Gama
Please remove the word "nazi" from the website, Joseph Gama
- Re: Please remove the word "nazi" from the website, Brian
  - Re: Please remove the word "nazi" from the website, Joseph Gama
    - Re: Please remove the word "nazi" from the website, John Nagro
    - Re: Please remove the word "nazi" from the website, Paul Schmehl
    - Re: Please remove the word "nazi" from the website, Jason
    - Re: Please remove the word "nazi" from the website, Brian
  - RE: Please remove the word "nazi" from the website, Yaakov Yehudi
- RE: Please remove the word "nazi" from the website, Nick Duda
  - RE: Please remove the word "nazi" from the website, Seth Art
- RE: Please remove the word "nazi" from the website, Tony Hernandez
- Re: Please remove the word "nazi" from the website, bmc
- RE: Please remove the word "nazi" from the website, Thompson, Jimi
- RE: Please remove the word "nazi" from the website, Adrian Marsden
- RE: Please remove the word "nazi" from the website, Thompson, Jimi
rukes for worms, Joseph Gama
new rules 8, Joseph Gama
new rules 5, Joseph Gama
XSS rules, Joseph Gama
- Re: XSS rules, Matthew Jonkman
new rules 2, Joseph Gama
- RE: new rules 2, Harper, Patrick
  - RE: new rules 2, Joseph Gama
- RE: new rules 2, patrick . harper
  - Re: new rules 2, Matthew Jonkman
- RE: new rules 2, patrick . harper
new rules 4, Joseph Gama
new rules 6, Joseph Gama
new rules 7, Joseph Gama
new rules 3, Joseph Gama
snort-rules update @ Tue Aug 10 10:39:14 2004, bmc
- Re: snort-rules update @ Tue Aug 10 10:39:14 2004, Burak DAYIOGLU
- Re: snort-rules update @ Tue Aug 10 10:39:14 2004, Brian
  - MS04-22 - Rule ?, Michael Sconzo
snort-rules 2.1.* update @ Tue Aug 10 10:02:57 2004, bmc
Rule 1797 triggered by Win XP SP2 download, Gregoire Hostettler
- Re: Rule 1797 triggered by Win XP SP2 download, Matthew Jonkman
false negative on sig 688, Steven Bairstow
- Re: false negative on sig 688, Steven Bairstow
Quickie rule to catch the new price.zip virus going around, Paul Tinsley
- Re: Quickie rule to catch the new price.zip virus going around, Matthew Jonkman
  - Re: Re: Quickie rule to catch the new price.zip virus going around, Paul Tinsley
    - Re: Quickie rule to catch the new price.zip virus going around, Matthew Jonkman
    - Help on an ICMP rule: sid 486, Seth Art
    - Re: Help on an ICMP rule: sid 486, Alex Kirk
    - Re: Help on an ICMP rule: sid 486, Seth Art
    - Re: Help on an ICMP rule: sid 486, Alex Kirk
    - Re: Help on an ICMP rule: sid 486, Seth Art
    - Re: Help on an ICMP rule: sid 486, Alex Kirk
    - Re: Help on an ICMP rule: sid 486, Brian
    - Re: Help on an ICMP rule: sid 486, Daniel Roelker
    - Re: Help on an ICMP rule: sid 486, Ben Dugdale
false positive for SID 1288, flatline
the signatures of same sid exist in web-php.rules., Kei Takai
False Positives on sid 1690, Matthew Jonkman
- Re: False Positives on sid 1690, Joseph Gama
What's wrong with this rule?, Paul Schmehl
- Re: What's wrong with this rule?, sekure
  - Re: What's wrong with this rule?, Paul Schmehl
- RE: What's wrong with this rule?, Esler, Joel - Contractor
  - RE: What's wrong with this rule?, Paul Schmehl
2 WEB-IIS unicode directory rules, Mark
- Re: 2 WEB-IIS unicode directory rules, Brian
Binet Malware Rules, Miner, Jonathan W (CSC) (US SSA)
- Re: Binet Malware Rules, Matthew Jonkman
SID 1436: MULTIMEDIA Quicktime User Agent access, Stephan Scholz
- Re: SID 1436: MULTIMEDIA Quicktime User Agent access, Alex Kirk
libpng tRNS overflow signature, Joe Stewart
FP in Rule 2515 ?, Federico Petronio
- RE: FP in Rule 2515 ?, Esler, Joel - Contractor
Ares signature?, Tony Hernandez
- Re: Ares signature?, Brian
- RE: Ares signature?, marcamone
  - Re: Ares signature?, Alex Kirk
    - Re: Ares signature?, Matthew Jonkman
  - Re: Ares signature?, Alex Kirk
SnortSAM + Oinkmaster, Gustavo
- Re: SnortSAM + Oinkmaster, Andreas Östling
Missing sid-msg.map entry for some rules, nnposter
Understanding content rules, Erik de Castro Lopo
- Re: Understanding content rules, Alex Kirk
Would these sasser rules catch all sasser variants?, Lin Zhong
- Re: Would these sasser rules catch all sasser variants?, Matthew Watchinski
False positive(s) for rule Sid 2229, Richard Huffman
- Re: False positive(s) for rule Sid 2229, Brian
snort-rules CURRENT update @ Fri Jul 23 16:34:53 2004, bmc
snort-rules 2.1.* update @ Fri Jul 23 16:38:05 2004, bmc
False positive on sig "WEB-MISC apache DOS attempt", Gustavo
- Re: False positive on sig "WEB-MISC apache DOS attempt", Matthew Watchinski
snort-rules 2.1.* update @ Wed Jul 21 11:27:54 2004, bmc
- Re: snort-rules 2.1.* update @ Wed Jul 21 11:27:54 2004, Brian
snort-rules 2.1.* update @ Thu Jul 22 17:16:10 2004, bmc
Fasle Positive for Sid: 1841, Colin Tinker
SID: 895 False Positives, Aaron Dalton
Avoidance of 2597.2 (WEB-MISC Samba SWAT Authorization overflow attempt), nnposter
- Re: Avoidance of 2597.2 (WEB-MISC Samba SWAT Authorization overflow attempt), Brian
sid 1257 false positive, "Benjamin Montré (pro)"
New Sid: MISC HP Web JetAdmin ExecuteFile admin access, Thomas Alex
- Re: New Sid: MISC HP Web JetAdmin ExecuteFile admin access, Matthew Jonkman
Discrepancy between rule files and sid-msg.map, Brennen Reynolds
- Re: Discrepancy between rule files and sid-msg.map, Brian
false positive for ID # 1917, Adam C. Knepprath
Re: sid:2578 sid 2579, Chris McClincy
WEB-MISC cross site scripting attempt - false positive addition, G. Panula
- Re: WEB-MISC cross site scripting attempt - false positive addition, Nigel Houghton
Change to false positives for rule 1948, A . Jones
RE: FP on BLEEDING-EDGE Pwdump3e Password Hash Retrieval, Eaglesfield, Andy
False positive for #0-(1-140), Mark Lidstone
false positive BLEEDING-EDGE HTTP CONNECT Tunnel Attempt, Matt Ostiguy
RE: pwdump, l0phtcrack, hash extraction, Abe Use
- Re: pwdump, l0phtcrack, hash extraction, Matthew Jonkman
Update for Sid: 2570 [Addition of False Positive info], Brandon Galbraith
RE: [Snort-sigs] Re: ViruSNORT, Matt Jonkman
Re: False positive on rule SID 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt, Matthew Watchinski
Update Rules, Gustavo
- Re: Update Rules, Keith W. McCammon
  - RE: Update Rules, Jeff Dell
Bleeding Malware bad sig format on 2001050, Joshua Roth
- Re: Bleeding Malware bad sig format on 2001050, Matthew Jonkman
AW: ViruSNORT, Maetzky, Steffen (Extern)
- Re: AW: ViruSNORT, jeffs
  - Re: AW: ViruSNORT, Cilin
  - Re: Re: AW: [Snort-users] ViruSNORT, Matthew Jonkman
false positve for SID 2404 and SID 2466, Stefan Sabolowitsch
false positive for sid 2087, Chris Kronberg
- Re: false positive for sid 2087, Matt Kettler
RE: What is the & operator in byte_test for?, Matt Kettler
- Re: What is the & operator in byte_test for?, Alex Kirk
BleedingSnort.com Updates, Matthew Jonkman
- Re: BleedingSnort.com Updates, Keith W. McCammon
  - Re: BleedingSnort.com Updates, Frank Knobbe
    - Re: BleedingSnort.com Updates, Matthew Jonkman
Re: [Snort-sigs] http_inspect, Brian caswell
- Re: [Snort-sigs] http_inspect, Jeremy Hewlett
- RE: RE: [Snort-sigs] http_inspect, Esler, Joel - Contractor
- RE: [Snort-sigs] http_inspect, Esler, Joel - Contractor
RE: Re: [Snort-users] ViruSNORT, Matt Jonkman
ViruSNORT, David Glosser
- Re: ViruSNORT, Charles Heselton