[Snort-users] snort ok now

Y M snort at ...15979...
Sat Apr 20 06:40:40 EDT 2013


As I said before, it is better to send help requests and/or solutions to the list and not in private. Other people may benefit and there are highly skilled people that can provide good information.

Having that said, did you review the VRT ruleset? You may find what you are looking for; indicator-shellcode.rules might be a good start.

Thanks.
________________________________
From: MCLEOD, DONNIE<mailto:DMCLEO11 at ...16247...>
Sent: ‎4/‎20/‎2013 12:55 PM
To: Y M<mailto:snort at ...15979...>
Subject: RE: snort ok now

Hi YM , could you help with a rule for shell code?  that I can use in the rules, thanks


Don,
________________________________
From: Y M [snort at ...15979...]
Sent: 19 April 2013 16:55
To: MCLEOD, DONNIE
Cc: snort-users at lists.sourceforge.net
Subject: RE: snort ok now

Glad it is working now. Please post to the entire list as it may help someone else.

Thanks.

________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130420/8588cca6/attachment.html>


More information about the Snort-users mailing list