[Snort-users] MS-SQL Worm Signature

Frank Reid fcreid at ...691...
Sat Jan 25 08:07:03 EST 2003

This rule gives me an error (aside from the trailing semicolon)...
anyone have a working version?  Thanks!


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of
Sent: Saturday, January 25, 2003 9:16 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] MS-SQL Worm Signature

hi all, i've done a simple signature for detecting this worm, it should 
work (or at least, it works here :P)

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"HELL-SQL Worm Scan";


If there are errors plz correct me, thanx a lot to all, happy fishing :)

SpP/Member www.spippolatori.com
UIC Founder www.quequero.tk
Linux Registered User #207978 

This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list