[Snort-sigs] Rule thoughts

James Lay jlay at ...3266...
Thu Sep 6 15:52:14 EDT 2012


On 2012-09-06 13:25, lists at ...3397... wrote:
> On 09/06/12 14:08, James Lay wrote:
>> Any pointers would help...thank
>
> What about:
>
> content:"mailto:<"; isdataat:1500,relative; content:!">"; 
> within:1501;

Thanks Nathan...that helps my understanding.

James




More information about the Snort-sigs mailing list