[Emerging-Sigs] 2 SIGS: W32/Dexter & W32/Stabuniq

Will Metcalf wmetcalf at emergingthreatspro.com
Fri Dec 28 11:24:02 HAST 2012


Cool your other two are going in today. Sorry for the delay.

Regards,

Will

On Fri, Dec 28, 2012 at 11:51 AM, Darren Spruell <phatbuckett at gmail.com>wrote:

> > content:"/rssnews.php"; http_uri;
>
> Beware that the URI path is variable; e.g. also seen:
>
> yolanda911[.]com/rss.php
>
>
> http://webcache.googleusercontent.com/search?q=cache:SjlDF9YN0UwJ:www.threatexpert.com/report.aspx%3Fmd5%3Deb392255167979b2f147ec101357f6dd+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a
>
> --
> Darren Spruell
> phatbuckett at gmail.com
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at lists.emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro
> http://www.emergingthreatspro.com
> The ONLY place to get complete premium rulesets for all versions of
> Suricata and Snort 2.4.0 through Current!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20121228/27a14229/attachment.html>


More information about the Emerging-sigs mailing list