[Emerging-Sigs] Gozi/Ordergun/Orderjack sig mod + new

Darren Spruell phatbuckett at gmail.com
Thu Jan 29 17:57:03 EST 2009


On Thu, Jan 29, 2009 at 1:52 PM, Holste, Martin C - DOA
<martin.holste at wisconsin.gov> wrote:
> Also, don't forget that Sourcefire added the http_method modifier so we
> could do:
>
> content:"GET"; http_method; uricontent:"/forms.cgi";

I think the concern might be requiring a recent enough snort to do the
http_* options (don't recall when that was added, 2.8.3? Pretty
recent.)

-- 
Darren Spruell
phatbuckett at gmail.com


More information about the Emerging-sigs mailing list