[Snort-sigs] SID 663, SMTP rcpt to sed command attempt
Hugo van der Kooij
hvdkooij at ...481...
Sun Jul 13 14:16:09 EDT 2003
On Sun, 13 Jul 2003, Nathan Bain wrote:
> The documentation for SID 663, SMTP rcpt to sed command attempt, says
> there are no known false positives. However, Snort has given me several
> apparent false positives.
I can confirm these findings. While they happen once a week it seems the
message is a false positive.
All email sent to me is bound to the rules described on my homepage.
hvdkooij at ...481... http://hvdkooij.xs4all.nl/
Don't meddle in the affairs of sysadmins,
for they are subtle and quick to anger.
More information about the Snort-sigs