[Snort-sigs] SQLSLAMMER signature

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Sat Jan 25 09:34:03 EST 2003


and if you're looking for people attempting it against you, switch home
and external nets.

-----Original Message-----
From: Dirk Mueller [mailto:dmuell at ...433...] 
Sent: Saturday, January 25, 2003 8:45 AM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] SQLSLAMMER signature


Hi, 

here's a signature for the SQL slammer worm that is spreading quickly:

alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg: "SQLSLAMMER";
content: 
"dllhel32hkernQhounthickChGetTf"; classtype:bad-unknown;)


-- 
Dirk (received 308 mails today)


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs




More information about the Snort-sigs mailing list