[Snort-sigs] warez site sigs

Chris Green cmg at ...26...
Thu Dec 21 13:17:47 EST 2000


This msg should be RETR rather than STOR
> alert tcp any any -> $HOME_NET 21 (msg:"STOR 1MB - possible warez site"; flags:PA; content:"RETR 1MB"; nocase; depth: 8;)
-- 
Chris Green <cmg at ...26...>
Life is a series of rude awakenings.
                -- R.V. Winkle




More information about the Snort-sigs mailing list