[Snort-sigs] Unsubscribe

Joe Patterson jpatterson at ...2901...
Mon Mar 14 14:42:14 EST 2005


Hmmm...

alert tcp any any -> $SMTP_SERVERS 25 (msg:"Someone is failing to
unsubscribe"; content:"unsubscribe"; nocase; content:!"mailman-request@";)

Yes, it's specific to mailman, but it's a place to start.  (not that I'd
actually run this rule anywhere...)

-Joe

> -----Original Message-----
> From: snort-sigs-admin at lists.sourceforge.net
> [mailto:snort-sigs-admin at lists.sourceforge.net]On Behalf Of Nick Hatch
> Sent: Saturday, March 12, 2005 2:25 PM
> To: snort-sigs at lists.sourceforge.net
> Subject: Re: [Snort-sigs] Unsubscribe
>
>
> I'm not sure if any rules for detecting unsubscribe messages to email
> list distribution addresses or not. I think you're right -- they would
> be a good idea though.
>
> -Nick
>
> P.S. I know brevity is good and all, but it took me a while to figure
> out what you were talking about.
>
> Hazel, Scott A. wrote:
>
> > Unsubscribe
> >
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
>





More information about the Snort-sigs mailing list