security.ids.snort.sigs (thread)

Invalid HTTP Strig, Goodson, Jacob
Possible Falsy, Goodson, Jacob
New bleeding virus rules (Korgo.P), Nick Hatch
- Re: New bleeding virus rules (Korgo.P), Matt Jonkman
Mime type filtering when looking for GDI+, Lazarakis, Dan
- Re: Mime type filtering when looking for GDI+, Russell Fulton
  - Help Me, Javier Guamán
    - Re: Help Me, Geoffrey Sanders
How to detect Skype?, Hernandez Huerta Higinio
- Re: How to detect Skype?, james edwards
- Re: How to detect Skype?, Jason Haar
Bleeding Snort Howto, Matt Jonkman
GDI Sig, Matt Jonkman
bleedingmalware sigs and severity, David Glosser
- Re: bleedingmalware sigs and severity, Matt Jonkman
  - Re: bleedingmalware sigs and severity, Burak DAYIOGLU
    - Re: bleedingmalware sigs and severity, David Glosser
    - Re: bleedingmalware sigs and severity, Matt Jonkman
- Re: bleedingmalware sigs and severity, Alex Butcher, ISC/ISYS
- bleedingmalware sigs and severity, Caracal GH
  - Re: bleedingmalware sigs and severity, Matt Jonkman
    - Re: bleedingmalware sigs and severity, Brian
    - Re: bleedingmalware sigs and severity, Matt Jonkman
    - Re: bleedingmalware sigs and severity, David Glosser
    - Re: bleedingmalware sigs and severity, Gregoire Hostettler
  - Re: bleedingmalware sigs and severity, Burak DAYIOGLU
|3B|id, Worthy
- Re: |3B|id, Nigel Houghton
  - Re: |3B|id, Daniel Roelker
New Bleedingsnort.com Rulesets!!!, Matt Jonkman
edonkey rules, Chich Thierry
- Re: edonkey rules, Matt Jonkman
- Re: edonkey rules, Jose Maria Lopez
False positive for rule 1:1365, Worthy
- Re: False positive for rule 1:1365, Mike Pomraning
- RE: False positive for rule 1:1365, Truax, Shawn (MBS)
snort-rules update @ Wed Sep 22 10:15:46 2004, bmc
Barnyard Choking, James Ashton
Barnyard Choking., James Ashton
- Re: Barnyard Choking., Alex Butcher, ISC/ISYS
  - Re: Barnyard Choking., Mailing Lists
- Re: Barnyard Choking., sekure
- RE: Barnyard Choking., James Ashton
PCRE for SS#'s, Harper, Patrick
- RE:PCRE for SS#'s, nnposter
  - Re: PCRE for SS#'s, Jim Zajkowski
    - Re: PCRE for SS#'s, nnposter
- Re: PCRE for SS#'s, Matt Jonkman
JPEG / GDI+ DLL exploit sig?, Frank Knobbe
- RE: JPEG / GDI+ DLL exploit sig?, Chas Tomlin
  - RE: JPEG / GDI+ DLL exploit sig?, Frank Knobbe
  - Re: JPEG / GDI+ DLL exploit sig?, Paul Tinsley
    - Re: JPEG / GDI+ DLL exploit sig?, Mailing Lists
which new tags with which snort version?, Chris Kronberg
False Positives on Rule 2050, John Duksta
what's the type of Pattrem matching slgorithm in sonrt???, mehdi gholami
- Re: what's the type of Pattrem matching slgorithm in sonrt???, sekure
  - Re: [Snort-sigs] what's the type of Pattrem matching slgorithm in sonrt???, Daniel Roelker
Re: " ..MS Terminal Server no encryption.. " misfire?, Ben Dugdale
False positives on FTP command 100 character limit, Sander Steffann
snort not logging into database, neha agrawal
- Re: snort not logging into database, John Nagro
Need sig to alert on webmail file attachments, Jeffrey Lowe
- Re: Need sig to alert on webmail file attachments, Nigel Houghton
False +ves on 2590, Russell Fulton
false positive for 2517, IMAP PCT Client_Hello overflow attempt, Serge Pashenkov
smtp pass rules, David Lowless
help with LSASS rule, Wohlberg, Jonathan
- Re: help with LSASS rule, Keith W. McCammon
- RE: help with LSASS rule, Wohlberg, Jonathan
- RE: help with LSASS rule, Esler, Joel - Contractor
  - Re: help with LSASS rule, Nigel Houghton
Broken 2671.1 (WEB-CLIENT bitmap BitmapOffset integer overflow attempt), nnposter
Typo in 2418.3 msg field, nnposter
format of data logged in mysql database, neha agrawal
how to see the log from database, neha agrawal
- Re: how to see the log from database, Geoffrey Sanders
AW: snort not logging into mysql, Lutz Schildt
snort not logging into mysql, neha agrawal
- Re: snort not logging into mysql, Geoffrey Sanders
- RE: snort not logging into mysql, Esler, Joel - Contractor
false positive for 1:2383 - NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt, Peter A. Peterson II
- Re: false positive for 1:2383 - NETBIOS SMB-DS DCERPC NTLMSSP asn1 overflow attempt, Brian
P2P eDonkey Signatures, Sam Evans
PCRE in 1930.4 (IMAP auth literal overflow attempt), nnposter
- Re: PCRE in 1930.4 (IMAP auth literal overflow attempt), Brian
  - Re: PCRE in 1930.4 (IMAP auth literal overflow attempt), Brian caswell
Avoidance of 2664.1 (IMAP login format string attempt), nnposter
Avoidance of 2665.1 (IMAP login literal format string attempt), nnposter
Re: SSH Scans, Federico Petronio
- Re: SSH Scans, Matt Jonkman
- Re: SSH Scans Slightly off topic but related......., Jeff Price
  - Re: SSH Scans Slightly off topic but related......., John Nagro
  - Re: SSH Scans Slightly off topic but related......., Chris Kronberg
    - Re: SSH Scans Slightly off topic but related......., Ben Whaley
DameWare rule, Ole-Martin
- Re: DameWare rule, Matt Jonkman
UPDATE TO BLEEDINGSNORT RULESETS!!!!, Matt Jonkman
- Re: UPDATE TO BLEEDINGSNORT RULESETS!!!!, Rocio Alfonso Pita
  - Re: UPDATE TO BLEEDINGSNORT RULESETS!!!!, John Duksta
  - Re: UPDATE TO BLEEDINGSNORT RULESETS!!!!, Chich Thierry
  - Re: UPDATE TO BLEEDINGSNORT RULESETS!!!!, Jose Maria Lopez
snort-rules update @ Tue Sep 7 18:15:41 2004, bmc
snort-rules update @ Tue Sep 7 16:15:38 2004, bmc
More questions re: logging and formatting, Sconeboy The Magnificent
Pb with rule 2000346, Chich Thierry
False positive: zincite, Chich Thierry
- Re: False positive: zincite, twebster
  - Re: False positive: zincite, Matt Jonkman
    - Re: False positive: zincite, Matt Jonkman
typot false positives?, Joerg Weber
- Re: typot false positives?, John Nagro
  - Re: typot false positives?, ICOSTAFF
- Re: typot false positives?, andreas
Using snort to view/log MSN traffic, Sconeboy The Magnificent
- Re: Using snort to view/log MSN traffic, Matthew Watchinski
  - Re: Using snort to view/log MSN traffic, Matt Jonkman
    - Re: Using snort to view/log MSN traffic, Jose Maria Lopez
3 new rules, Joseph Gama
- Re: 3 new rules, Brian
  - Re: 3 new rules, Joseph Gama
    - Re: 3 new rules, Jason Haar
phishing, etc, Joseph Gama
VNC Failed Login, sekure
- Re: [Snort-users] VNC Failed Login, Andreas Östling
  - Re: Re: [Snort-users] VNC Failed Login, sekure
- Re: VNC Failed Login, Frank Knobbe
  - Re: [Snort-sigs] Re: VNC Failed Login, Nigel Houghton
Re: Snorting gzip encoded http source code, Jason Haar
- Re: Snorting gzip encoded http source code, Jose Maria Lopez
New idea in change tracking for nets, Matt Jonkman
- Re: New idea in change tracking for nets, Frank Knobbe
  - Re: New idea in change tracking for nets, Brian Howard
    - Re: New idea in change tracking for nets, Matt Jonkman
  - Re: New idea in change tracking for nets, Matt Jonkman
    - Re: New idea in change tracking for nets, Frank Knobbe
  - Re: New idea in change tracking for nets, Jason Haar
    - Re: New idea in change tracking for nets, Frank Knobbe
- Re: New idea in change tracking for nets, Stef
Re: Bleedingsnort.com Daily Update, Matt Jonkman
- Re: Bleedingsnort.com Daily Update, Jose Maria Lopez
- Re: Bleedingsnort.com Daily Update, Hugo van der Kooij
  - Re: Bleedingsnort.com Daily Update, Andreas Östling
    - Re: Bleedingsnort.com Daily Update, Jose Maria Lopez
  - Re: Bleedingsnort.com Daily Update, Jose Maria Lopez
- Bleedingsnort.com Daily Update, matt
- RE: Bleedingsnort.com Daily Update, James Ashton
  - RE: Bleedingsnort.com Daily Update, Jose Maria Lopez
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Re: Bleedingsnort.com Daily Update, Ben Dugdale
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
RE: secure connection to bleedingsnort.com, Frank Knobbe
- Re: secure connection to bleedingsnort.com, James Riden
- Re: secure connection to bleedingsnort.com, Matt Jonkman
  - Re: secure connection to bleedingsnort.com, Matt Jonkman
    - Re: secure connection to bleedingsnort.com, John Nagro