Snort mailing list archives
Re: False positives on mysql traffic
From: "Joel Esler (jesler)" <jesler () cisco com>
Date: Tue, 24 Feb 2015 11:54:39 +0000
Is it possible you can provide a pcap of the false positive triggering? -- Joel Esler Sent from my iPhone On Feb 23, 2015, at 9:48 PM, James Dickenson <jdickenson () gmail com<mailto:jdickenson () gmail com>> wrote: Has anyone else noticed these signatures creating false positives on mysql traffic (usually 3306). Anyone have any thoughts on how to tune it out? alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant registration message"; flow:to_server,established; content:"|41 00 00 00 03|"; depth:5; dsize:<160; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/<http://www.circl.lu/pub/tr-23/>; classtype:trojan-activity; sid:32609; rev:2;) alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.NetWiredRC variant keepalive"; flow:to_server,established; content:"|01 00 00 00 02|"; depth:5; dsize:5; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop; reference:url,www.circl.lu/pub/tr-23/<http://www.circl.lu/pub/tr-23/>; classtype:trojan-activity; sid:32610; rev:1;) -James ------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net> Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- False positives on mysql traffic James Dickenson (Feb 23)
- Re: False positives on mysql traffic Joel Esler (jesler) (Feb 25)