[Snort-sigs] Netsky.P Signature

Jason Haar Jason.Haar at ...651...
Tue Mar 23 17:31:55 EST 2004

On Tue, Mar 23, 2004 at 08:03:26AM -0600, Mark.Schutzmann at ...2233... wrote:
> I can't wait for all of the FP's on this one... but at least it will be
> fast ;-)

I wouldn't say FPs - but the msg should be something more like 

msg:"Email OUTBOUND bad file attachment";

as this rule merely notices e-mails with attachments typically assosiated
with viruses - not viruses themselves. You could say it was more of a
"policy-violation" rule perhaps...


Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

More information about the Snort-sigs mailing list