[Snort-sigs] SQLSLAMMER signature

Dirk Mueller dmuell at ...433...
Sat Jan 25 06:46:01 EST 2003


Hi, 

here's a signature for the SQL slammer worm that is spreading quickly:

alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg: "SQLSLAMMER"; content: 
"dllhel32hkernQhounthickChGetTf"; classtype:bad-unknown;)


-- 
Dirk (received 308 mails today)




More information about the Snort-sigs mailing list