[Snort-sigs] Rig Exploit Kit outbound URI request signature

lists at ...3397... lists at ...3397...
Thu Jul 10 12:42:13 EDT 2014


On 07/10/2014 11:39 AM, Geoffrey Serrao wrote:
> Ideally I'd like to include at least a 'depth' modifier or 'urilen' before the
> content match. We shall see what comes out of testing!

Good stuff -- if my data helps mind releasing these under VRT COMMUNITY?  Thanks

Cheers,
Nathan Fowler




More information about the Snort-sigs mailing list