<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Joel, <BR> <BR>I am NOT the author of the rule. I was reading the article in hope to find something to sig on and I found the rule written already. cert-bund.de are the authors.<BR> <BR>YM<br> <BR><div><hr id="stopSpelling">From: jesler@...3865...<br>To: snort@...3751...<br>CC: snort-sigs@...1369....net<br>Subject: Re: [Snort-sigs] Ebury SSH Rootkit sig.<br>Date: Sat, 15 Feb 2014 18:02:03 +0000<br><br><div>Did you author the rule?  <br><br>--<div>Joel Esler</div><div>Sent from my iPhone</div></div><div><br>On Feb 15, 2014, at 10:17, "Y M" <<a href="mailto:snort@...3751...">snort@...3320...751...</a>> wrote:<br><br></div><blockquote><div>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}

.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}

--></style>
<div dir="ltr">The sig is provided/available at <a href="https://www.cert-bund.de/ebury-faq" target="_blank">https://www.cert-bund.de/ebury-faq</a>, near the end of the page.<br> <br>YM<br> <br> <br>                                      </div>
</div></blockquote><blockquote><div><span>------------------------------------------------------------------------------</span><br><span>Android apps run on BlackBerry 10</span><br><span>Introducing the new BlackBerry 10.2.1 Runtime for Android apps.</span><br><span>Now with support for Jelly Bean, Bluetooth, Mapview and more.</span><br><span>Get your Android app in front of a whole new audience.  Start now.</span><br><span><a href="http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk</a></span></div></blockquote><blockquote><div><span>_______________________________________________</span><br><span>Snort-sigs mailing list</span><br><span><a href="mailto:Snort-sigs@...3134...ourceforge.net">Snort-sigs@lists.sourceforge.net</a></span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/snort-sigs" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-sigs</a></span><br><span><a href="http://www.snort.org" target="_blank">http://www.snort.org</a></span><br><span></span><br><span></span><br><span>Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> for the latest news about Snort!</span></div></blockquote></div>                                        </div></body>
</html>