[Snort-users] SQLsnake - any able to create a sig for this one?
Roberto Suarez Soto
robe at ...3881...
Wed May 22 01:48:03 EDT 2002
On May/21, john at ...5909... wrote:
> Has anyone be able to put together a sig for the scanning done bye SQLsnake
> (the MSSQL worm) which supposedly uses "fscan.exe" packaged as another file.
> A full code analysis and facts about it can be found here:
This explains why I noticed such a huge amount of probes to 1433/tcp
these last days :-) Was I the only one?
Roberto Suarez Soto Alfa21 Outsourcing
robe at ...3881... http://www.alfa21.com
More information about the Snort-users