[Snort-sigs] Netsky.c + others? attachment sid

Scott Zawalski scott.zawalski at ...1089...
Mon Mar 1 11:55:09 EST 2004

alert tcp any any -> any any (msg:"NetSky.c Attachment content"; 
content:"UEsDBA"; classtype:trojan-activity; sid:1000010; rev:1;)

I set the port to any instead of 25 because the virus sends also over 
other ports.

Any comments/suggestions are welcome


More information about the Snort-sigs mailing list