[Snort-sigs] SQLSLAMMER signature

Kreimendahl, Chad J Chad.Kreimendahl at ...361...
Sat Jan 25 09:34:03 EST 2003

and if you're looking for people attempting it against you, switch home
and external nets.

-----Original Message-----
From: Dirk Mueller [mailto:dmuell at ...433...] 
Sent: Saturday, January 25, 2003 8:45 AM
To: snort-sigs at lists.sourceforge.net
Subject: [Snort-sigs] SQLSLAMMER signature


here's a signature for the SQL slammer worm that is spreading quickly:

alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg: "SQLSLAMMER";
"dllhel32hkernQhounthickChGetTf"; classtype:bad-unknown;)

Dirk (received 308 mails today)

This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list