security.ids.snort.sigs (date)

November 30, 2004

Re: netbios rules, grep
snort-rules update @ Mon Nov 29 22:15:39 2004, bmc
Bleedingsnort.com Daily Update, bleeding

November 29, 2004

Re: bleeding.rules.tar.gz over SSL is broken, Astarna
Re: bleeding.rules.tar.gz over SSL is broken, Matt Jonkman
Re: The rule 1054 fires up false positives!, Victor Meghesan
bleeding.rules.tar.gz over SSL is broken, Astarna
How to verify the new snort rules ?, Eddie
Snortcenter and updating rules, John Hally
Re: Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Alex Kirk

November 28, 2004

Re: (no subject), Brian caswell
Re: (no subject), warwick ackfin
RE: A newb question on Snort Rules, nnposter
Bleedingsnort.com Daily Update, bleeding
Re: (no subject), warwick ackfin
(no subject), nnposter

November 27, 2004

Bleedingsnort.com Daily Update, bleeding

November 26, 2004

Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, nnposter
A newb question on Snort Rules, warwick ackfin
Bleedingsnort.com Daily Update, bleeding

November 25, 2004

False +ves for 2657 EXPLOIT SSLv2 Client_Hello with pad Challenge Length overflow attempt, Russell Fulton
Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Russell Fulton
Re: The rule 1054 fires up false positives!, nnposter
Bleedingsnort.com Daily Update, bleeding
Craig C Anderson/seh is out of the office., Craig C Anderson
Hi!, roesch
Re: sig 2671, Matthew Watchinski
Re: The rule 1054 fires up false positives!, Matt Kettler

November 24, 2004

RE: Strange behavior with http_inspect_server, Joe Patterson
Re: Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman
netbios rules, Tim Slighter
Re: Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg
Re: Substitute for removed MS04-028 exploiting jpeg rule?, Alex Kirk
Re: Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman
Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg
Bleedingsnort.com Daily Update, bleeding

November 23, 2004

Bleedingsnort.com Daily Update, bleeding
Re: The rule 1054 fires up false positives!, Matt Kettler

November 22, 2004

Strange behavior with http_inspect_server, Joe Patterson
False Positive: Snort Sig 1980: BACKDOOR Deepthroat 3.1 Connection attempt, Nagendra, Vasuki
Re: The rule 1054 fires up false positives!, Victor Meghesan
Bleedingsnort.com Daily Update, bleeding

November 21, 2004

Re: The rule 1054 fires up false positives!, Matthew Watchinski
Re: False Negative Submission, Matthew Watchinski
Bleedingsnort.com Daily Update, bleeding

November 20, 2004

Re: what triggers spp_stream4: TTL Evasion attempt, Matt Kettler
Bleedingsnort.com Daily Update, bleeding

November 19, 2004

Re: False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), Nigel Houghton
(no subject), Doug McLean
sig 2671, James Affeld
Dragon sigs to SNORT, Richard Ferro
web-attacks.rules: many false positives, Benjamin Case
DNS Spoof probably has false positive, chatiman
The rule 1054 fires up false positives!, Victor Meghesan
False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), McKenzie, Omar
False Negative Submission, Matthew K. Lee
False Positive Report for SID 2109, Peter M. Abraham
Re: Multiple content requirements in single rule, force order requirement, Jason

November 18, 2004

Re: what triggers spp_stream4: TTL Evasion attempt, Nigel Houghton
what triggers spp_stream4: TTL Evasion attempt, Russell Fulton
RE: Multiple content requirements in single rule, force order requirement, Gould, Scott
Re: Multiple content requirements in single rule, force order requirement, Alex Kirk
Multiple content requirements in single rule, force order requirement, Gould, Scott
Re: Any sigs for detecting wireless activity?, Nick
Any sigs for detecting wireless activity?, Jeffrey Lowe
Bleedingsnort.com Daily Update, bleeding

November 17, 2004

False Positive for 1386, Esler, Joel - Contractor
Bleedingsnort.com Daily Update, bleeding

November 16, 2004

SID 2001439 fails on Bleedingsnort Rulesets, Rocio Alfonso Pita
Bleedingsnort.com Daily Update, bleeding

November 15, 2004

Re: False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk
Bleedingsnort.com Daily Update, bleeding

November 13, 2004

Re: False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij
Case-sensitivity in 2570.6 (WEB-MISC Invalid HTTP Version String), nnposter

November 12, 2004

Re: False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk
Re: False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij
Re: False +ves on 2586 -- P2P eDonkey transfer, Matt Jonkman
Re: False +ves on 2586 -- P2P eDonkey transfer, Chich Thierry
Bleedingsnort.com Daily Update, bleeding

November 11, 2004

Re: snort-rules update @ Thu Nov 11 15:27:17 2004, Brian
snort-rules update @ Thu Nov 11 15:27:17 2004, bmc
Bleedingsnort.com Daily Update, bleeding

November 10, 2004

False +ves on 2586 -- P2P eDonkey transfer, Russell Fulton
Possible False Positive on SID 2381???, Seth Art
Re: Bleedingsnort.com Daily Update, Matt Jonkman
Re: Bleedingsnort.com Daily Update, Jason Haar
Bleedingsnort.com Daily Update, bleeding

November 09, 2004

Re: Korgo.X, Matt Jonkman
Korgo.X, Rowland, Krisa W ERDC-ITL-MS Contractor

November 08, 2004

Re: Alert Cache, Nigel Houghton
Alert Cache, Paul McMonagle

November 06, 2004

Re: [SIFTER] Sensitive Content, Matt Jonkman
[SIFTER] Sensitive Content, Mail Administrator
[SIFTER] Sensitive Content, Mail Administrator
Case-sensitivity in 542.10 (CHAT IRC nick change), nnposter

November 05, 2004

RE: Proposal for addition of author to standard rule listings, Kevin L. Shaw
RE: Proposal for addition of author to standard rule listings, James Ashton
Re: Proposal for addition of author to standard rule listings, Frank Knobbe
Re: Proposal for addition of author to standard rule listings, Nigel Houghton
RE: Proposal for addition of author to standard rule listings, M. Shirk
Re: Proposal for addition of author to standard rule listings, Chich Thierry
Bleedingsnort.com Daily Update, matt

November 04, 2004

Re: Proposal for addition of author to standard rule listings, Brian
Re: Proposal for addition of author to standard rule listings, Hugo van der Kooij
Bleedingsnort.com Daily Update, matt
Re: Bleedingsnort.com Daily Update, Matt Jonkman
Re: Proposal for addition of author to standard rule listings, Jason
Re: Proposal for addition of author to standard rule listings, Frank Knobbe
Re: Proposal for addition of author to standard rule listings, Jason
Re: Bleedingsnort.com Daily Update, James Riden

November 03, 2004

Re: Proposal for addition of author to standard rule listings, Matt Jonkman
Re: Proposal for addition of author to standard rule listings, Matt Jonkman
Re: Proposal for addition of author to standard rule listings, Nigel Houghton
Re: Proposal for addition of author to standard rule listings, Frank Knobbe
Re: Proposal for addition of author to standard rule listings, Brian
Re: Proposal for addition of author to standard rule listings, Nigel Houghton
Re: Bleedingsnort.com Daily Update, Brian
Proposal for addition of author to standard rule listings, Frank Knobbe
RPC errors, Rowland, Krisa W ERDC-ITL-MS Contractor
Bleedingsnort.com Daily Update, matt

November 02, 2004

Re: False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman
RE: False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary
Re: False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman
False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary
Re: help us help you, Brian
Re: suggested changes to rule 2229, Matthew Watchinski
[Snort-users] help us help you, Brian

November 01, 2004

help us help you, Brian
Bleedingsnort.com Daily Update, matt