[Snort-sigs] Sig for Worm Swen.a?

Robert Wagner rwagner at ...447...
Tue Sep 23 06:44:06 EDT 2003

Thanks to all that replied -

I am using Rule 2, and looked at the packets and made another rule.  I am
not sure exactly what I am keying off of (I picked it up out of the packets
following a bunch of AAAA's).  I think I am getting a slightly higher hit

alert tcp any any -> any 25 (msg:"Rule 2 W32/Gibe-F,Aliases-W32/Swen.A at ...110...,
794C|";tag: session,300,packets ;rev:1; sid:2000016;)
alert tcp any any -> any 25 (msg:"Rule 3 W32/Gibe-F,Aliases-W32/Swen.A at ...110...,
discovered ";content:"1NP3//1P/lTD9//+JReSFwHQxgKQF0P7//wBqAY2";tag:
session,300,packets ;rev:1; sid:2000016;)

Let me know what you think.  (Or are there a couple different versions of
this worm and one doesn't talk back to the website?)

-----Original Message-----
From: Robert Wagner [mailto:rwagner at ...447...]
Sent: Monday, September 22, 2003 8:21 AM
To: Snort-Sigs (E-mail)
Subject: [Snort-sigs] Sig for Worm Swen.a?

Does anyone have a good signature for this worm?

This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list