security.ids.snort.sigs (thread)

snort-rules update @ Mon Nov 29 22:15:39 2004, bmc
bleeding.rules.tar.gz over SSL is broken, Astarna
- Re: bleeding.rules.tar.gz over SSL is broken, Matt Jonkman
  - Re: bleeding.rules.tar.gz over SSL is broken, Astarna
How to verify the new snort rules ?, Eddie
Snortcenter and updating rules, John Hally
A newb question on Snort Rules, warwick ackfin
- (no subject), nnposter
  - Re: (no subject), warwick ackfin
    - RE: A newb question on Snort Rules, nnposter
    - Re: (no subject), warwick ackfin
    - Re: (no subject), Brian caswell
False +ves for 2657 EXPLOIT SSLv2 Client_Hello with pad Challenge Length overflow attempt, Russell Fulton
Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Russell Fulton
- Re: Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, Alex Kirk
- Flase +ves for SID 2590 SMTP MAIL FROM overflow attempt, nnposter
Craig C Anderson/seh is out of the office., Craig C Anderson
Hi!, roesch
netbios rules, Tim Slighter
- Re: netbios rules, grep
Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg
- Re: Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman
  - Re: Substitute for removed MS04-028 exploiting jpeg rule?, Alex Kirk
    - Re: Substitute for removed MS04-028 exploiting jpeg rule?, Chris Kronberg
    - Re: Substitute for removed MS04-028 exploiting jpeg rule?, Matt Jonkman
Strange behavior with http_inspect_server, Joe Patterson
- RE: Strange behavior with http_inspect_server, Joe Patterson
False Positive: Snort Sig 1980: BACKDOOR Deepthroat 3.1 Connection attempt, Nagendra, Vasuki
(no subject), Doug McLean
sig 2671, James Affeld
- Re: sig 2671, Matthew Watchinski
Dragon sigs to SNORT, Richard Ferro
web-attacks.rules: many false positives, Benjamin Case
DNS Spoof probably has false positive, chatiman
The rule 1054 fires up false positives!, Victor Meghesan
- Re: The rule 1054 fires up false positives!, Matthew Watchinski
  - Re: The rule 1054 fires up false positives!, Victor Meghesan
    - Re: The rule 1054 fires up false positives!, Matt Kettler
    - Re: The rule 1054 fires up false positives!, Victor Meghesan
    - Re: The rule 1054 fires up false positives!, Matt Kettler
    - Re: The rule 1054 fires up false positives!, nnposter
False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), McKenzie, Omar
- Re: False Positive on rule ID 1365 (WEB-ATTACKS rm command attempt), Nigel Houghton
False Negative Submission, Matthew K. Lee
- Re: False Negative Submission, Matthew Watchinski
False Positive Report for SID 2109, Peter M. Abraham
what triggers spp_stream4: TTL Evasion attempt, Russell Fulton
- Re: what triggers spp_stream4: TTL Evasion attempt, Nigel Houghton
  - Re: what triggers spp_stream4: TTL Evasion attempt, Matt Kettler
Multiple content requirements in single rule, force order requirement, Gould, Scott
- Re: Multiple content requirements in single rule, force order requirement, Alex Kirk
- RE: Multiple content requirements in single rule, force order requirement, Gould, Scott
  - Re: Multiple content requirements in single rule, force order requirement, Jason
Any sigs for detecting wireless activity?, Jeffrey Lowe
- Re: Any sigs for detecting wireless activity?, Nick
False Positive for 1386, Esler, Joel - Contractor
SID 2001439 fails on Bleedingsnort Rulesets, Rocio Alfonso Pita
Case-sensitivity in 2570.6 (WEB-MISC Invalid HTTP Version String), nnposter
snort-rules update @ Thu Nov 11 15:27:17 2004, bmc
- Re: snort-rules update @ Thu Nov 11 15:27:17 2004, Brian
False +ves on 2586 -- P2P eDonkey transfer, Russell Fulton
- Re: False +ves on 2586 -- P2P eDonkey transfer, Chich Thierry
  - Re: False +ves on 2586 -- P2P eDonkey transfer, Matt Jonkman
  - Re: False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij
    - Re: False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk
    - Re: False +ves on 2586 -- P2P eDonkey transfer, Hugo van der Kooij
    - Re: False +ves on 2586 -- P2P eDonkey transfer, Alex Kirk
Possible False Positive on SID 2381???, Seth Art
Korgo.X, Rowland, Krisa W ERDC-ITL-MS Contractor
- Re: Korgo.X, Matt Jonkman
Alert Cache, Paul McMonagle
- Re: Alert Cache, Nigel Houghton
[SIFTER] Sensitive Content, Mail Administrator
- [SIFTER] Sensitive Content, Mail Administrator
  - Re: [SIFTER] Sensitive Content, Matt Jonkman
Case-sensitivity in 542.10 (CHAT IRC nick change), nnposter
Proposal for addition of author to standard rule listings, Frank Knobbe
- Re: Proposal for addition of author to standard rule listings, Nigel Houghton
- Re: Proposal for addition of author to standard rule listings, Brian
  - Re: Proposal for addition of author to standard rule listings, Frank Knobbe
    - Re: Proposal for addition of author to standard rule listings, Nigel Houghton
    - Re: Proposal for addition of author to standard rule listings, Matt Jonkman
- Re: Proposal for addition of author to standard rule listings, Matt Jonkman
- Re: Proposal for addition of author to standard rule listings, Jason
  - Re: Proposal for addition of author to standard rule listings, Frank Knobbe
    - Re: Proposal for addition of author to standard rule listings, Jason
    - Re: Proposal for addition of author to standard rule listings, Hugo van der Kooij
  - Re: Proposal for addition of author to standard rule listings, Brian
    - Re: Proposal for addition of author to standard rule listings, Chich Thierry
    - Re: Proposal for addition of author to standard rule listings, Frank Knobbe
- RE: Proposal for addition of author to standard rule listings, M. Shirk
  - Re: Proposal for addition of author to standard rule listings, Nigel Houghton
- RE: Proposal for addition of author to standard rule listings, James Ashton
- RE: Proposal for addition of author to standard rule listings, Kevin L. Shaw
RPC errors, Rowland, Krisa W ERDC-ITL-MS Contractor
False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary
- Re: False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman
- RE: False Positive for Probable Zafi Vrus outbound via SMTP rul, Kalbfleisch, Gary
  - Re: False Positive for Probable Zafi Vrus outbound via SMTP rul, Matt Jonkman
Re: suggested changes to rule 2229, Matthew Watchinski
[Snort-users] help us help you, Brian
help us help you, Brian
- Re: help us help you, Brian
Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
  - Re: Bleedingsnort.com Daily Update, Brian
    - Re: Bleedingsnort.com Daily Update, James Riden
    - Re: Bleedingsnort.com Daily Update, Matt Jonkman
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, matt
- Bleedingsnort.com Daily Update, bleeding
  - Re: Bleedingsnort.com Daily Update, Jason Haar
    - Re: Bleedingsnort.com Daily Update, Matt Jonkman
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding
- Bleedingsnort.com Daily Update, bleeding