[Snort-sigs] Unknown EK

lists at ...3397... lists at ...3397...
Tue Jul 2 21:51:02 EDT 2013

On 07/02/2013 06:31 PM, Joel Esler wrote:
> I am sure you meant depth:2;.  But in the rule I am committing, I’m not putting
> a depth, doesn’t look like we need it really.
> Also, in the second rule, the colon after the second content match, is a semi
> colon, probably just a typo.

Yeah, I was running on empty by the time I set the email out but wanted the
community to be aware of the in-use EK to prevent future infection.  Thanks Joel
for cleaning up the mess and giving the signatures some TLC.


More information about the Snort-sigs mailing list