Re: cmd.exe

["Michael Scheidell" <scheidell () fdma com>]

----- Original Message ----- 
From: "Ronald Prins" <prins () fox-it com>
Newsgroups: local.snort.users
Sent: Monday, April 29, 2002 4:37 AM
Subject: [Snort-users] cmd.exe


> We are monitoring multiple sensors for a number of customers (The
> Netherlands). We noticed a recent increase in the number of SID: 1002
> "cmd.exe" attempts. 
>
> Have others noticed the same?
Massive increase, all over, cmd.exe, root.exe, vti-bin, etc.
Code red awoke...

FlexResp question:

which response do you think? rst_all icmp_host? what?


> Ronald.
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> ---

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users