[Snort-sigs] Storm worm rule

Matthew Watchinski mwatchinski at ...435...
Wed Feb 13 17:00:12 EST 2008


offset is counted from the beginning of payload, and dsize is the size 
of payload.  So if the payload is only 2 to 25 bytes then offset can't 
be 47 cause that is outside the bounds of the payload.

I'm assuming |10 a6| is in the first couple bytes of the UDP payload so 
your offset is most like 0 if it's the first two bytes of the payload.

Cheers,
-matt

Paul Schmehl wrote:
> This is a packet capture of a known storm-infected host.  Normal data payload 
> size is either 2 bytes or 25 bytes.
> 
> 0000  00 0f 23 aa 37 40 00 0d  ed ac 93 40 81 00 00 02   ..#.7 at ...202... ... at ...552...
> 0010  08 00 45 00 00 35 85 2b  00 00 74 11 ef 1c 81 6e   ..E..5.+ ..t....n
> 0020  f1 06 80 67 df 93 f7 9b  1c 52 00 21 94 10 10 a6   ...g.... .R.!....
> 0030  4b 69 53 29 56 b1 29 22  8b a9 ad 3c 22 0b 3a 8d   KiS)V.)" ...<".:.
> 0040  e2 53 17 15 81 49 46                               .S...IF
> 
> The signature |10 a6| at byte 47 is the indication of an encrypted eDonkey 
> session (typically used by Storm along with UDP.
> 
> So, would this be the correct syntax?  alert udp blah(msg:"blah"; dsize:2<>25; 
> content:"|10 a6|"; offset:47; blah.  Or am I missing something?
> 





More information about the Snort-sigs mailing list