[Snort-users] MS-SQL Worm Signature

-=Quequero=- quequero at ...8067...
Sat Jan 25 06:17:01 EST 2003

hi all, i've done a simple signature for detecting this worm, it should 
work (or at least, it works here :P)

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"HELL-SQL Worm Scan"; 

If there are errors plz correct me, thanx a lot to all, happy fishing :)

SpP/Member www.spippolatori.com
UIC Founder www.quequero.tk
Linux Registered User #207978 

More information about the Snort-users mailing list