Re: FP on EXPLOIT-KIT Angler(1:31046)

[Andre DiMino <adimino () sempersecurus org>]

Thanks Joel

On Wed, Jan 7, 2015 at 2:27 PM, Andre DiMino <adimino () sempersecurus org> wrote:
> Yea, I'm looking to just negate the 'http" portion.  Maybe "aHR0c"
> would be better.
>
> On Wed, Jan 7, 2015 at 1:56 PM, lists () packetmail net
> <lists () packetmail net> wrote:
> > On 01/07/2015 12:49 PM, Andre DiMino wrote:
> > > Actually, the negation I used is uricontent:!"aHR0cDovL";
> >
> > But isn't that just addressing:
> >
> > http://email-assets.car-hound.com/ch_auto_brands1.png
> >
> >
> > ------------------------------------------------------------------------------
> > Dive into the World of Parallel Programming! The Go Parallel Website,
> > sponsored by Intel and developed in partnership with Slashdot Media, is your
> > hub for all things parallel software development, from weekly thought
> > leadership blogs to news, videos, case studies, tutorials and more. Take a
> > look and join the conversation now. http://goparallel.sourceforge.net
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs () lists sourceforge net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> > http://www.snort.org
> >
> >
> > Please visit http://blog.snort.org for the latest news about Snort!
>
>
>
> --
>
> Andre' M. DiMino
> DeepEnd Research
> http://deependresearch.org
> http://sempersecurus.org
>
> "Make sure that nobody pays back wrong for wrong, but always try to be
> kind to each other and to everyone else" - 1 Thess 5:15 (NIV)



-- 

Andre' M. DiMino
DeepEnd Research
http://deependresearch.org
http://sempersecurus.org

"Make sure that nobody pays back wrong for wrong, but always try to be
kind to each other and to everyone else" - 1 Thess 5:15 (NIV)

------------------------------------------------------------------------------
Dive into the World of Parallel Programming! The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!