Fwd: Fwd: [Snort-sigs] Rule for MSWord GinWin.

Ureleet Ureleet ureleet at ...2420...
Fri May 26 05:49:05 EDT 2006


I do not have a pcap for it.  This was a preemptive signature based
off of the virus info.  Please not to write me asking for pcap
anymore.  If I had one, it would be given to the people at VRT.



---------- Forwarded message ----------
From: Blake Hartstein <bhartstein at ...274...>
Date: May 23, 2006 12:35 PM
Subject: Re: Fwd: [Snort-sigs] Rule for MSWord GinWin.
To: Ureleet Ureleet <ureleet at ...2420...>
Cc: rmkml at ...324...


Send that pcap my way too if it is available.
Thanks,
Blake


Ureleet Ureleet wrote:

> ---------- Forwarded message ----------
> From: rmkml <rmkml at ...324...>
> Date: May 23, 2006 7:59 AM
> Subject: Re: [Snort-sigs] Rule for MSWord GinWin.
> To: Ureleet Ureleet <ureleet at ...2420...>
>
>
> Hi,
> thx,
> do you have snort output or pcap file ?
> Best Regards
> Rmkml
>
>
> On Tue, 23 May 2006, Ureleet Ureleet wrote:
>
>> Date: Tue, 23 May 2006 07:31:27 -0400
>> From: Ureleet Ureleet <ureleet at ...2420...>
>> To: snort-sigs at lists.sourceforge.net
>> Subject: [Snort-sigs] Rule for MSWord GinWin.
>>
>> I have written a rule to detect the MS Word virus GinWin vulnerability
>> on our network, and am sharing with community.
>>
>> It's not the best rule, and I hope VRT comes out with something
>> better, but this rule basically looks for the dns queries that the
>> virus performs.
>>
>> alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"COMMUNITY VIRUS
>> GinWui infected host"; content:"|01 00|"; offset:2; depth:2;
>> pcre:"/((\x05scfzf\x04xicp\x03net)|(\x0alocalhosts\x043322\x03org))/Ri";
>> rev:1;)
>>
>> Please review.
>>
>>
>> -------------------------------------------------------
>> Using Tomcat but need to do more? Need to support web services,
>> security?
>> Get stuff done quickly with pre-integrated technology to make your
>> job easier
>> Download IBM WebSphere Application Server v.1.0.1 based on Apache
>> Geronimo
>> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>> _______________________________________________
>> Snort-sigs mailing list
>> Snort-sigs at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>>
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs



--
This email and any files transmitted with it are solely intended for
the use of the addressee(s) and may contain information that is
confidential and privileged.  If you receive this email in error,
please advise us by return email immediately. Please also disregard
the contents of the email, delete it and destroy any copies
immediately.  Demarc Security, Inc. does not accept liability for the
views expressed in the email or for the consequences of any computer
viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be
reproduced, adapted or transmitted without the written consent of the
copyright owner.




More information about the Snort-sigs mailing list