[Snort-users] Some worm?

Jan Hugo Prins jhp at ...11270...
Sun Apr 11 12:48:01 EDT 2004


Lately I get a lot of events that are grouped. First I get a "WEB-MISC
WebDAV search access" alert, then a "(http_inspect) BARE BYTE UNICODE
ENCODING"  alert and after that 18 "SHELLCODE x86 NOOP" alerts.

Is there some worm that tries to propagate using these signatures?

Jan Hugo

More information about the Snort-users mailing list