[Snort-sigs] Rule thoughts

lists at ...3397... lists at ...3397...
Thu Sep 6 15:25:50 EDT 2012


On 09/06/12 14:08, James Lay wrote:
> Any pointers would help...thank 

What about:

content:"mailto:<"; isdataat:1500,relative; content:!">"; within:1501;




More information about the Snort-sigs mailing list