Re: [Snort-sigs] Not looking in Email

From: security people <securitypeople(at)hotmail.com>
Date: Wed May 21 2003 - 23:30:59 EDT

Use something like the following:

alert tcp any any <> $SMTP_SERVERS 25 (msg:"ETCPASSWD"; flags:A+; content: "/etc/passwd"; sid:1000004;)

Note the bidirectional sign <>

• Original Message ----- From: "Esler, Joel Contractor" <EslerJ@RCERT-S.ARMY.MIL> To: <snort-sigs@lists.sourceforge.net> Sent: Wednesday, May 21, 2003 10:16 PM Subject: [Snort-sigs] Not looking in Email

> I know it has to be possible, to write a rule that will look for
however,
> is there a way I can make it NOT look in email? like if I define my SMTP

---

This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Thu May 22 00:13:50 2003