[Snort-users] Hotmail

John Maestrale jmaestrale at ...5809...
Wed Jun 19 11:03:04 EDT 2002


Does this look correct. I am trying to alert on Hotmail login attempts.

alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"MSN Hotmail"; flags: A+;
uricontent: "/ppsecure/login"; nocase; classtype:misc-activity; rev:1;)

Thanks

John Maestrale,SSCP






More information about the Snort-users mailing list