Re: [Snort-sigs] Netsky.P Signature

On Tue, Mar 23, 2004 at 08:03:26AM -0600, Mark.Schutzmann@Omron.com wrote:
>
> I can't wait for all of the FP's on this one... but at least it will be

I wouldn't say FPs - but the msg should be something more like

msg:"Email OUTBOUND bad file attachment";

as this rule merely notices e-mails with attachments typically assosiated with viruses - not viruses themselves. You could say it was more of a "policy-violation" rule perhaps...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.
http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs