Snort mailing list archives
Re: SIP scanner sig
From: Alex McDonnell <amcdonnell () sourcefire com>
Date: Tue, 1 Oct 2013 11:38:19 -0400
Hi YM. we have rules that cover sipvicious, if those help. SIDS 27899-27904 thanks Alex McDonnell VRT On Tue, Oct 1, 2013 at 11:17 AM, Y M <snort () outlook com> wrote:
Caught this one live today. I can't share the pcap, sorry for that. alert udp $EXTERNAL_NET any -> $HOME_NET $SIP_PORTS (msg:"INDICATOR-SCAN Sipvicious SIP scanner detected"; flow:to_server; sip_method:options; content:"User-Agent|3A| friendly-scanner|0D0A|"; fast_pattern:only; content:"From|3A| |22|sipvicious|22|"; metadata:ruleset community; classtype:misc-activity; sid:100051; rev:1;) The sip_method may not be necessary to generalize the signature, any ideas? I can't download the scanner and verify at the moment. Thanks. YM ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- SIP scanner sig Y M (Oct 01)
- Re: SIP scanner sig Alex McDonnell (Oct 01)
- Re: SIP scanner sig Y M (Oct 01)
- Re: SIP scanner sig Alex McDonnell (Oct 01)
- Re: SIP scanner sig Y M (Oct 01)
- <Possible follow-ups>
- Re: SIP scanner sig Y M (Oct 01)
- Re: SIP scanner sig Alex McDonnell (Oct 01)