Re: NETBIOS nimda.eml

[Jason Haar <Jason.Haar () trimble co nz>]

On Wed, Oct 22, 2003 at 01:00:32PM -0400, Paul Lane wrote:
> This rule is generating lots of alerts on my network;
>
> "alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS nimda .eml";
> content:"|00|.|00|E|00|M|00|L"; flow:to_server,established;
> classtype:bad-unknown;
> reference:url,www.f-secure.com/v-descs/nimda.shtml; sid:1293; rev:8;);
> ...
> The source IP is an Exchange 2000 server and the destination IP is a
> file server. I've made sure that these boxes are patched and the virus
> dat file are current. 

What the rule does is trigger when it sees someone copying *.eml files onto
a SMB share. Sounds like you have some app which is (say) backing up
Exchange 2K mail messages onto a file server? Hense the presense of all
those .eml files.

Besides that, it's a useful rule, how about changing it to

alert tcp !$MAIL_SERVERS any -> ...

And define MAIL_SERVERS to be the IP addresses of your Exchange servers?

[I'm guessing EXTERNAL_NET == HOME_NET in your example]

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This SF.net email is sponsored by OSDN developer relations
Here's your chance to show off your extensive product knowledge
We want to know what you know. Tell us and you have a chance to win $100
http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users