[Snort-sigs] Re: [ISSForum] Witty signature

From: Sergey V Soldatov <SVSoldatov(at)tnk.ru> Date: Thu Mar 25 2004 - 08:45:59 EST · _______________________________________________

---
Best regards, Sergey V. Soldatov.

              todb@planb-security.net                                                                               
              Sent by:                         To:       snort-sigs@lists.sourceforge.net, issforum@iss.net         
              issforum-bounces@iss.net         cc:                                                                  
                                               Subject:  [ISSForum] Witty signature                                 

              20.03.2004 14:17                                                                                      

Pretty easy one:

alert udp any 4000 -> any any (msg:"ISS RealSecure or BlackICE Witty
Infection Attempt"; content:"|20 20 20 20 20
20|insert.witty.message.here"; depth:146; classtype:trojan-activity;
reference:url,
http://xforce.iss.net/xforce/alerts/id/166; sid:1111001;
rev:1;)

Mostly useful for the Trons crowd (drop disallowed Trons fields
accordingly).

--
Tod Beardsley
www.planb-security.net

_______________________________________________

ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________

ISSForum mailing list
ISSForum@iss.net
Do you need help? 
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related snort.org Links
snort-announce
snort-cvsinfo
snort-devel
snort-sigs
snort-users
Request more information about Pantek

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.
http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs