Re: Anyone got a sig for SMB Nimda?

[Brian <bmc () snort org>]

According to Jason Haar:
> If no-one has done it, can someone tell me how to read SMB packets so as to
> write a rule that alerts on any SMB session containing the string
> "readme.exe"?

Robert Graham posted one to FOCUS-IDS a while back.  I've added that
signature and a number of others.  For simplicity, I have attached those 
signatures.  

> [Shouldn't we start a set of "smb.rules"?]

Already exists.  netbios.rules

-- 
You are a very redundant person, that's what kind of person you are.

Attachment: sigs
Description: