[Snort-users] Black/Nyxem

Ron Jenkins rjenkins at ...12829...
Thu Jan 26 10:19:04 EST 2006

On the below rule, does anyone show the payload as:


GET /cgi-bin/Count.cgi?df=765247 HTTP/1.1..Accept: */*..Referer:
<http://www.snort.org/rules/advisories/vrt-rules-2006-01-25.html> . 






alert tcp $HOME_NET any -> 80 (msg:"COMMUNITY VIRUS
Possible BlackWorm or Nymex infected host";
uricontent:"/cgi-bin/Count.cgi?df=765247"; sid:100000226; rev:1;)





Ron Jenkins (SnortCP, MCNE, CNE6, MCP, CCNA, CCEA)
Senior Architect
Data Integrity, LLC
"We Integrate People with Solutions"
1724 Dallas Drive
Suite 11
Baton Rouge, La 70806
Office. 225.927.8030
Fax. 225.927.8033

Email. rjenkins at ...12829...
Web. http://www.dibr.net

(Aanval Reseller and Technology Partner)



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20060126/c9ccc1fd/attachment.html>

More information about the Snort-users mailing list