[Snort-sigs] Netsky.P Signature

Mark.Schutzmann at ...2233... Mark.Schutzmann at ...2233...
Tue Mar 23 07:12:18 EST 2004

I can't wait for all of the FP's on this one... but at least it will be
fast ;-)

                      Brian <bmc at ...95...>                                                                                                      
                      Sent by:                           To:       "Cam Beasley, ISO" <cam at ...2154...>                                    
                      snort-sigs-admin at ...551...        cc:       snort-sigs at lists.sourceforge.net                                              
                      ceforge.net                        Subject:  Re: [Snort-sigs] Netsky.P Signature                                           
                      03/22/2004 06:36 PM                                                                                                        

On Mon, Mar 22, 2004 at 04:24:29PM -0600, Cam Beasley, ISO wrote:
> alert tcp any any -> any 25 (msg:"Netsky.P";
> content:"EtLD/LKApGoCW/8UJHP3M8n/FCRzGDPA/xQkcyGzAkGwEP8UJBLAc/l1P6rr3Oh
> DAAAAK8t1";
> classtype:misc-attack; rev:1;)

Or you could use my super signature :P  BTW, this single rule is faster
than the previous method of 19 different virus rules *AND* it detects
more bad juju.

from virus.rules:

# We don't care about virus rules anymore.  BUT, you people won't stop
# asking us for virus rules.  So... here ya go.
# There is now one rule that looks for any of the following attachment
# types:
#   ade, adp, asd, asf, asx, bat, chm, cli, cmd, com, cpp, diz, dll,
#   dot, emf, eml, exe, hlp, hsq, hta, ini, js, jse, lnk, mda, mdb, mde,
#   mdw, msi, msp, nws, ocx, pif, pl, pm, pot, pps, ppt, reg, rtf, scr,
#   shs, swf, sys, vb, vbe, vbs, vcf, vxd, wmd, wmf, wms, wmz, wpd, wpm,
#   wps, wpz, wsc, wsf, wsh, xls, xlt, xlw

alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"VIRUS OUTBOUND bad file
attachment"; flow:to_server,established; content:"Content-Disposition|3a|";
 classtype:suspicious-filename-detect; sid:721; rev:6;)


This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
Snort-sigs mailing list
Snort-sigs at lists.sourceforge.net

More information about the Snort-sigs mailing list