[Snort-sigs] Netsky.P Signature

Brian bmc at ...95...
Mon Mar 22 16:38:01 EST 2004


On Mon, Mar 22, 2004 at 04:24:29PM -0600, Cam Beasley, ISO wrote:
> alert tcp any any -> any 25 (msg:"Netsky.P";
> content:"EtLD/LKApGoCW/8UJHP3M8n/FCRzGDPA/xQkcyGzAkGwEP8UJBLAc/l1P6rr3Oh
> DAAAAK8t1";
> classtype:misc-attack; rev:1;)

Or you could use my super signature :P  BTW, this single rule is faster
than the previous method of 19 different virus rules *AND* it detects
more bad juju.

from virus.rules:

# We don't care about virus rules anymore.  BUT, you people won't stop
# asking us for virus rules.  So... here ya go.
#
# There is now one rule that looks for any of the following attachment
# types:
#
#   ade, adp, asd, asf, asx, bat, chm, cli, cmd, com, cpp, diz, dll,
#   dot, emf, eml, exe, hlp, hsq, hta, ini, js, jse, lnk, mda, mdb, mde,
#   mdw, msi, msp, nws, ocx, pif, pl, pm, pot, pps, ppt, reg, rtf, scr,
#   shs, swf, sys, vb, vbe, vbs, vcf, vxd, wmd, wmf, wms, wmz, wpd, wpm,
#   wps, wpz, wsc, wsf, wsh, xls, xlt, xlw
#

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND bad file attachment"; flow:to_server,established; content:"Content-Disposition|3a|"; nocase; pcre:"/filename\s*=\s*.*?\.(?=[abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[stw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s]/iR"; classtype:suspicious-filename-detect; sid:721; rev:6;)

Brian




More information about the Snort-sigs mailing list