[Snort-sigs] another THCISSLame.c sig (s/flags/flow/)

rocco.s rocco.s at ...2432...
Tue Apr 27 07:50:31 EDT 2004


alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"THCIISLame exploitation attempt"; flow:to_server, established; content:"|0f 54 48 43 4f 57 4e 5a 49 49 53 21|; sid:80045; rev:1; reference:url,thc.org; classtype:at
tempted-admin;) 

# 54 48 43 4f 57 4e 5a 49 49 53 21 = THCOWNZIIS!




                                                                      





More information about the Snort-sigs mailing list