[Snort-users] Snort 1U Appliance for Sale on EBay

Kreimendahl, Chad J Chad.Kreimendahl at ...4716...
Fri Feb 27 08:32:06 EST 2004


I just had a funny thought to go with this spam.  I encourage others to
share theirs as well.

Being that I've never bothered with sales people that use the term
turn-key... Maybe it's time to write a snort rule to detect this. (This
machine probably does what it says... But still...)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Salesman BS Overflow
Detected"; pcre:"/turn[-\s]*key/i" classtype:"marketing-mumbojumbo";
sid:55378008; rev:1;)

Alternatively this rule could be switched around for source and
destination to detect when your sales people are using meaningless
mumbojumbo, etc...




More information about the Snort-users mailing list