<div dir="ltr"><div>Hmm is this interesting? Maybe disabled by default? Seems that it is just a normal thing the NVIDIA updae app does right?<br><br>Regards,<br><br></div>Will<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Feb 5, 2014 at 1:57 PM, rmkml <span dir="ltr"><<a href="mailto:rmkml@...174..." target="_blank">rmkml@...174...</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
After ISC/SANS talk, I'm offer a new rule for detecting Ping NVidia:<br>
<br>
alert icmp any any -> any any (msg:"ICMP PING NVIDIA NvNetworkService check access"; icode:0; itype:8; dsize:32; content:"PING DATA!"; depth:10; offset:0; reference:url,<a href="http://isc.sans.edu/forums/diary/Odd+ICMP+Echo+Request+Payload/17570" target="_blank">isc.sans.edu/<u></u>forums/diary/Odd+ICMP+Echo+<u></u>Request+Payload/17570</a>; classtype:misc-activity; sid:1; rev:1;)<br>

<br>
Please check all variables before use.<br>
<br>
All comments are welcome.<br>
<br>
Regards<br>
@Rmkml<br>
<br>
______________________________<u></u>_________________<br>
Emerging-sigs mailing list<br>
<a href="mailto:Emerging-sigs@...3694..." target="_blank">Emerging-sigs@...2570...<u></u>emergingthreats.net</a><br>
<a href="https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs" target="_blank">https://lists.emergingthreats.<u></u>net/mailman/listinfo/emerging-<u></u>sigs</a><br>
<br>
Support Emerging Threats! Subscribe to Emerging Threats Pro <a href="http://www.emergingthreats.net" target="_blank">http://www.emergingthreats.net</a><br>
The ONLY place to get complete premium rulesets for all versions of Suricata and Snort 2.4.0 through Current!<br>
</blockquote></div><br></div>