[Snort-sigs] Has a rule been created for this?

Adam Richards adam.richards at ...3481...
Tue Apr 13 12:04:53 EDT 2010


I have been seeing this obfuscated php file around a lot lately and I
wasn't sure if there was a rule yet for it. There are a few unique
strings in it that we can look for. 
http://webcache.googleusercontent.com/search?q=cache:MyKUomVp7rQJ:forums
.devnetwork.net/viewtopic.php%3Ff%3D34%26t%3D88942+L0oZuRpAnTz&cd=1&hl=e
n&ct=clnk&gl=us


Adam Richards,CISSP | CEH





More information about the Snort-sigs mailing list