Re: Vbs rat threat rules

["Joel Esler (jesler)" <jesler () cisco com>]

Perhaps the reason is, “vbs rat” isn’t a specific attack, it’s a generic term.  We have lots of detection for Remote 
Access Tools, which one is really the question.


On Jan 27, 2014, at 7:49 PM, Feroz Basir <feroz.basir () gmail com<mailto:feroz.basir () gmail com>> wrote:

Hi again,

Anybody knows? Please help. Thanks.


Regards,
Feroz Fazidi Bin Basir

On 25 Jan 2014, at 19:34, Feroz Basir <feroz.basir () gmail com<mailto:feroz.basir () gmail com>> wrote:

Hi all,

Anybody knows which rule that vrt uses for detecting VBS RAT threat? Im sniffing proxy packet which I think change the 
packet.

Thanks.


Regards,
Feroz Basir

------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today.
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!

------------------------------------------------------------------------------
WatchGuard Dimension instantly turns raw network data into actionable 
security intelligence. It gives you real-time visual feedback on key
security issues and trends.  Skip the complicated setup - simply import
a virtual appliance and go from zero to informed in seconds.
http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!