[Snort-sigs] Worm signature question

ids at ...2364... ids at ...2364...
Fri Apr 2 16:37:01 EST 2004

Hello everyone-

I have a general question about what signature get offcial release. Something that I noticed is that some worm signatures are not officially released. It has been my experience that worms that are classified as "Internet Worms" or worms that propagate directly through the Internet get signatures and worms classified as "email worms" or worms that spread through email do not. This would make sense since it is the anti-virus (on the mail server) responsibility to detect the email worms and a worm who is trying to propagte into your network from the Internet is no different than a hacker trying to break in (becoming Snorts resposibility to aler yout). I'm I correct in this assumption? 

More information about the Snort-sigs mailing list