[Snort-sigs] Unsubscribe

Esler, Joel CNTR/Sytex joel.esler at ...783...
Mon Mar 14 14:44:34 EST 2005


I'm sorry.  That's just funny.  I love the humor of us fellow IT people.

ROFL.


On Mon, 2005-03-14 at 17:41 -0500, Joe Patterson wrote:

> Hmmm...
> 
> alert tcp any any -> $SMTP_SERVERS 25 (msg:"Someone is failing to
> unsubscribe"; content:"unsubscribe"; nocase; content:!"mailman-request@";)
> 
> Yes, it's specific to mailman, but it's a place to start.  (not that I'd
> actually run this rule anywhere...)
> 
> -Joe
> 
> > -----Original Message-----
> > From: snort-sigs-admin at lists.sourceforge.net
> > [mailto:snort-sigs-admin at lists.sourceforge.net]On Behalf Of Nick Hatch
> > Sent: Saturday, March 12, 2005 2:25 PM
> > To: snort-sigs at lists.sourceforge.net
> > Subject: Re: [Snort-sigs] Unsubscribe
> >
> >
> > I'm not sure if any rules for detecting unsubscribe messages to email
> > list distribution addresses or not. I think you're right -- they would
> > be a good idea though.
> >
> > -Nick
> >
> > P.S. I know brevity is good and all, but it took me a while to figure
> > out what you were talking about.
> >
> > Hazel, Scott A. wrote:
> >
> > > Unsubscribe
> > >
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >
> >
> 
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

-- 
Esler, Joel CNTR/Sytex <joel.esler at ...783...>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20050314/c627c634/attachment.html>


More information about the Snort-sigs mailing list