Re: MS-SQL Worm Signature

[-=Quequero=- <quequero () bitchx it>]

> alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm 
> Activity";
> content:"|04 01 01 01 01 01 01 01|"; classtype:bad-unknown; sid:9994; rev:1;)


This worm does:

81 f1 03 01 04 9b    xor     ecx, 9B040103h
81 f1 01 01 01 01    xor     ecx, 1010101h
                     51   push    ecx

9B040103 xor  1010101 = 9A050002 = port 1434 -> AF_INET
So i think this sequence is unique enough to be used for a signature
like:

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm 
Activity";
content:"|81f10301049b81f101|"; classtype:bad-unknown; sid:9994; rev:1;)

What do you think?


-=Quequero=-
SpP/Member www.spippolatori.com
UIC Founder www.quequero.tk
Linux Registered User #207978  



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users