[Snort-sigs] Anyone having Netsky.b Signatures??

Cam Beasley, ISO cam at ...2154...
Fri Feb 27 13:29:04 EST 2004


Netsky.B/C (perhaps just variant C):
------------------------------------

alert tcp any any -> any 25 (msg:"Netsky n' Hutch";
content:"AACGAaK6i0QkBIPEKo2QNAAAAIPECGoQi9hmBS0AUFJqAIsb/xNq//9TDEVSUk9
SIQBDb3Jy";
classtype:misc-attack; rev:1;)

I would be interested to know of any
false positives/negatives you encounter.

~cam.


> -----Original Message-----
> From: snort-sigs-admin at lists.sourceforge.net 
> [mailto:snort-sigs-admin at lists.sourceforge.net] On Behalf Of 
> Chintan Gosalia
> Sent: Friday, February 27, 2004 12:56
> To: snort-sigs at lists.sourceforge.net
> Subject: [Snort-sigs] Anyone having Netsky.b Signatures??
> 
> 
> Hi,
>  
> Does anyone have netsky.b signature or payload for it??
>  
> Any help is appreciated.
>  
> Thanks.
> 
>   _____  
> 
> Do you Yahoo!?
> Get better spam protection with Yahoo! Mail 
> <http://us.rd.yahoo.com/mailtag_us/> *http://antispam.yahoo.com/tools>

> 




More information about the Snort-sigs mailing list