RE: Code Red Rule?

["John Berkers" <berjo () ozemail com au>]

For Snort 1.7 I would suggest content:".ida?";nocase , for snort 1.8
uricontent:".ida?";nocase

Removing the /default portion of the content makes the signature more
generic, since in theory the ida overflow could be done via index.ida as
well.  The ? reduces the number of false alerts as the ? is required to
produce the overflow.  Finally, the nocase removes any case sensitivity the
rule would otherwise have, which Windows doesn't.  It might also be
worthwhile to add a dsize: >239; flags A+ as per both Snort and Whitehats
rules to further reduce false positives.

The rule already exists in web-iis.rules from snort CVS since 19 June, and
also in Whitehats vision17.rules and vision18.rules from around the same
time.

Lets hope all the preparation has paid off!

Regards,

John Berkers
berjo () ozemail com au


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Richard
Parker
Sent: Tuesday, 31 July 2001 4:57
To: Snort-users () lists sourceforge net
Subject: [Snort-users] Code Red Rule?


Hi,

I'm relatively new to snort, could someone comment on this rule for
catching Code Red?

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"Code Red default.ida
attempt"; flags:PA; content:"GET /default.ida"; nocase;)

Is that right?

TIA

Rich

--
Richard Parker, Expressive Limited

-> bash luser
With what? Your bare hands?

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users