[Emerging-Sigs] 2012204 and 2011766 detect the same thing?

Matthew Jonkman jonkman at emergingthreatspro.com
Wed Oct 26 15:55:55 EDT 2011


On Oct 26, 2011, at 3:38 PM, waldo kitty wrote:
>>> 
>>> 
>>> 2012204 msg:"ET SCAN Modified Sipvicious Sundayddr Scanner (sipsscuser)";
> 
> change the existing 2012204 MSG to read as above... ??

Ahh, ok. Now I get what you were saying. :)

Done, thanks!

Matt



> 
>>> 2011766 msg:"ET SCAN Modified Sipvicious User-Agent Detected (sundayddr)";
> 
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 
> Support Emerging Threats! Subscribe to Emerging Threats Pro http://www.emergingthreatspro.com
> The ONLY place to get complete premium rulesets for Snort 2.4.0 through Current!


----------------------------------------------------
Matt Jonkman
Emerging Threats Pro
Open Information Security Foundation (OISF)
Phone 866-504-2523 x110
http://www.emergingthreatspro.com
http://www.openinfosecfoundation.org
----------------------------------------------------



More information about the Emerging-sigs mailing list