Polymorphic Shellcode detection

["ulfabodo" <ulfabodo () rediffmail com>]

Hi,
i wanted to find if the present ids'es are able to detect 
ploymorphic shellcodes a.k.a the ADMmutate and its variants. i had 
just gone through K2's article and at that time he claims that ISS 
was not able to detect the method which he has given.
What about the other IDS vendors? Have they been able to detect 
such exploits? Can anyone throw some light on how the detection 
mechanism might work??

thanks,
ub



-------------------------------------------------------------------------------
Can you respond to attacks based on attack type, severity, source IP,
destination IP, number of times attacked, or the time of day an attack
occurs? No? 
No wonder why you're swamped with false positives! 
Download a free 15-day trial of Border Guard and watch your false
positives disappear.

http://www.securityfocus.com/StillSecure-focus-ids2
-------------------------------------------------------------------------------