[Snort-sigs] W32.Bugbear.B at ...110... Signature

Tinsley Paul Paul.Tinsley at ...1517...
Fri Jun 6 06:00:06 EDT 2003


Bugbear seems to be a mean one, I ran across this signature on Symantec's
site.  Figured I would pass this along incase anybody needed it.

alert tcp any any -> any 139 (msg:"BugBear B Network Worm Propagation";
content:"|0B010600002001000010000000E006002001080000F00600001008000000400000
1000000002000004000000000000000400000000000000002008000010000000000000020000
0000001000001000000000100000100000000000001000000000000000000000000010080064
010000000000000000000000000000000000000000000000000000641108000C|";
content:"|555058300000000000E0060000100000|"; classtype:misc-activity;
sid:900019; rev:1;)

Thanks,
Paul Tinsley
Senior Security Engineer
Security Assurance
2555 Park Plaza, DC-3N
Nashville, TN 37075
Office: (615) 344-6403
Pager: (615) 960-7766 or paul.tinsley at ...1250...
Cell:    (615) 973-5353
mailto:paul.tinsley at ...1515...





More information about the Snort-sigs mailing list