[Snort-users] SQLsnake - any able to create a sig for this one?

Roberto Suarez Soto robe at ...3881...
Wed May 22 01:48:03 EDT 2002


On May/21, john at ...5909... wrote:

> Has anyone be able to put together a sig for the scanning done bye SQLsnake
> (the MSSQL worm) which supposedly uses "fscan.exe" packaged as another file.
> A full code analysis and facts about it can be found here:
> http://www.incidents.org/diary/diary.php?id=157.

	This explains why I noticed such a huge amount of probes to 1433/tcp
these last days :-) Was I the only one?

-- 
Roberto Suarez Soto					Alfa21 Outsourcing
    robe at ...3881...				     http://www.alfa21.com




More information about the Snort-users mailing list