Snort mailing list archives
Re: .exe
From: JJ Cummings <cummingsj () gmail com>
Date: Sat, 4 May 2013 08:23:41 -0600
The VRT ruleset contains rules looking for PE files also... Sent from the iRoad On May 4, 2013, at 7:18, James Lay <digitalx00 () gmail com> wrote:
Ho are you trying to test? Also check out Emerging Threat rules 2000419 and 2015744 for more info on rules that hit on exe. James On May 4, 2013, at 5:46 AM, tarik shalo <tarikshalo () gmail com> wrote:Hello, I wrote the following rule to test if Snort fires when any executable files are downloaded. However, the rule is not firing for some reason. Any help or other option to accomplish the same goal, pls? alert any any -> any any (msg: ".exe found"; flow:to_server,established; content:".exe"; nocase;classtype:policy-violation;sid:10000056;rev:1; ) -Shalo ------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- .exe tarik shalo (May 04)