[Snort-sigs] SQLsnake - any able to create a sig for this one?

john at ...604... john at ...604...
Tue May 21 19:08:02 EDT 2002


Has anyone be able to put together a sig for the scanning done bye 
SQLsnake (the MSSQL worm) which supposedly uses "fscan.exe" packaged as 
another file.  A full code analysis and facts about it can be found here: http://www.incidents.org/diary/diary.php?id=157.

-John




More information about the Snort-sigs mailing list