RE: Beagle traffic

["Paul Melson" <pmelson () gmail com>]

________________________________

Subject: [Snort-users] Beagle traffic

> Does anyone know what Beagle worm traffic looks like to Snort i.e. what
alerts will it 
> generate when detecting it?  What is the SID?


http://www.bleedingsnort.com/bleeding-virus.rules

bleeding-sid-msg.map:2000561 || BLEEDING-EDGE VIRUS Possible Bagle.AI Worm
Outbound
bleeding-sid-msg.map:2001065 || BLEEDING-EDGE VIRUS Possible Bagle.AQ Worm
Outbound
bleeding-sid-msg.map:2001269 || BLEEDING-EDGE VIRUS Beagle User Agent
Detected
bleeding-sid-msg.map:2001270 || BLEEDING-EDGE VIRUS Bagle Worm
bleeding-sid-msg.map:2001292 || BLEEDING-EDGE VIRUS Possible Bagle.AI Worm
bleeding-sid-msg.map:2001390 || BLEEDING-EDGE VIRUS Possible Beagle.AV Worm
Outbound
bleeding-sid-msg.map:2001391 || BLEEDING-EDGE VIRUS Possible Beagle.AV Worm
Inbound
bleeding-sid-msg.map:2001567 || BLEEDING-EDGE VIRUS Bagel - outbound
bleeding-sid-msg.map:2001568 || BLEEDING-EDGE VIRUS Bagel - incoming
bleeding-sid-msg.map:2001759 || BLEEDING-EDGE VIRUS Beagle.BK - outbound
bleeding-sid-msg.map:2001760 || BLEEDING-EDGE VIRUS Beagle.BK - incoming
bleeding-sid-msg.map:2002180 || BLEEDING-EDGE VIRUS W32.Beagle.CE@mm
Infection Outbound web.php


PaulM



-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users