[Snort-sigs] another sig for THCIISLame.c

rocco.s rocco.s at ...2432...
Tue Apr 27 07:50:25 EDT 2004



alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"THCIISLame exploitation attempt"; flags:A+; content:"|0f 54 48 43 4f 57 4e 5a 49 49 53 21|; sid:99999; rev:1; reference:url,thc.org; classtype:attempted-admin;) 

# 54 48 43 4f 57 4e 5a 49 49 53 21 = 'THCOWNZIIS!'


let progress me know




                                                                      





More information about the Snort-sigs mailing list