OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [snort] Rapidnet sig error?
From: Martin Roesch (roeschhiverworld.com)
Date: Tue Mar 07 2000 - 12:44:55 CST

Jim, you hear that?? :)

Stuart Staniford-Chen wrote:
>
> The following sig is in the Rapidnet set:
>
> alert tcp !$HOME_NET any -> $HOME_NET 80 (msg:"IIS-showcode";flags:PA;
> content:"msads/Samples/selector/showcode.asp";)
>
> Shouldn't that be "msadc" rather than "msads"?
>
> Thanks,
>
> Stuart.
>
> --
> Stuart Staniford-Chen --- President --- Silicon Defense
> stuartsilicondefense.com
> (707) 822-4588 (707) 826-7571 (FAX) 

-- 
Martin Roesch                      <roeschhiverworld.com>
Director of Forensic Systems     http://www.hiverworld.com
Hiverworld, Inc.               Enterprise Network Security
Network Forensics, Intrusion Detection and Risk Assessment