[Snort-users] False positive on sid:17246

Andy Berryman aberryman at ...14765...
Wed Sep 15 12:39:10 EDT 2010


Anyone getting false positives on this? I just did a rule update this
morning am now getting tons of events for this all of a sudden. 

 

SPECIFIC-THREATS Multiple vendor Antivirus magic byte detection evasion
attempt

 

Just seeing if anyone else is experiencing it? It looks like they are
triggering on gzip files. 

 

 

 

Thanks,

Andy Berryman


###############################################################################
This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above.  If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited.  If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail.                    
###############################################################################
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100915/d61d04df/attachment.html>


More information about the Snort-users mailing list