[Snort-sigs] Witty signature

todb at ...794... todb at ...794...
Sun Mar 21 07:19:03 EST 2004


> On Sat, Mar 20, 2004 at 05:17:35AM -0600, todb at ...794... wrote:
>> Pretty easy one:
>
> Yeah, except those are easily evadable.  Try these on for size.

Totally. Mine picks out one (1) version of the worm. Yours picks out the
exploit.

However, it looks like yours depends on Snort 2.x tests unsupported by
Trons  -- not that it matters for real Snort IDSers, or people relying on
ISS's new signature.

-- 
Tod




More information about the Snort-sigs mailing list