[Snort-users] SQLsnake - any able to create a sig for this one?

john at ...5909... john at ...5909...
Tue May 21 19:03:01 EDT 2002


Has anyone be able to put together a sig for the scanning done bye 
SQLsnake (the MSSQL worm) which supposedly uses "fscan.exe" packaged as 
another file.  A full code analysis and facts about it can be found here: http://www.incidents.org/diary/diary.php?id=157.

-John




More information about the Snort-users mailing list