[Snort-users] Re: MS-SQL Worm Signature

-=Quequero=- quequero at ...8067...
Sat Jan 25 11:43:02 EST 2003


>alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm 
>Activity";
>content:"|04 01 01 01 01 01 01 01|"; classtype:bad-unknown; sid:9994; rev:1;)


This worm does:

81 f1 03 01 04 9b    xor     ecx, 9B040103h
81 f1 01 01 01 01    xor     ecx, 1010101h
                      51   push    ecx

9B040103 xor  1010101 = 9A050002 = port 1434 -> AF_INET
So i think this sequence is unique enough to be used for a signature
like:

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm 
Activity";
content:"|81f10301049b81f101|"; classtype:bad-unknown; sid:9994; rev:1;)

What do you think?


-=Quequero=-
SpP/Member www.spippolatori.com
UIC Founder www.quequero.tk
Linux Registered User #207978  





More information about the Snort-users mailing list