Snort mailing list archives
Re: Rovnix UA sig
From: Joel Esler <jesler () sourcefire com>
Date: Mon, 5 Aug 2013 14:14:05 -0400
Thanks James. YM just submitted something very similar. On Mon, Aug 5, 2013 at 1:43 PM, James Lay <jlay () slave-tothe-box net> wrote:
I'm sure there's other things to match as well: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Rovnix UA detected"; content:"User-Agent|3a| FWVersionTestAgent"; fast_pattern:only; http_header; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.didierstevens.com/2013/08/04/quickpost-rovnix-pcap; classtype:trojan-activity; sid:10000088; rev:1;) James ------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
-- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
------------------------------------------------------------------------------ Get your SQL database under version control now! Version control is standard for application code, but databases havent caught up. So what steps can you take to put your SQL databases under version control? Why should you start doing it? Read more to find out. http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Rovnix UA sig James Lay (Aug 05)
- Re: Rovnix UA sig Joel Esler (Aug 05)
- Re: Rovnix UA sig James Lay (Aug 05)
- Re: Rovnix UA sig Joel Esler (Aug 05)
- Re: Rovnix UA sig Y M (Aug 05)
- Re: Rovnix UA sig James Lay (Aug 05)
- Re: Rovnix UA sig James Lay (Aug 05)
- Re: Rovnix UA sig Joel Esler (Aug 05)