[Emerging-Sigs] RogueAV (.BKM) Sig

waldo kitty wkitty42 at windstream.net
Mon Dec 31 08:33:05 HAST 2012

On 12/31/2012 12:52, yew chuan Ong wrote:
> Hi,
> I am thinking how we can put all four URI into one signature. Appreciate if
> anyone can help.

the only way i know would be PCRE but what are you going to anchor the initial 
content match to?

what is wrong with one sig per match? have the MSGs to be the same with a 
numerical indicator which is firing or some such?

More information about the Emerging-sigs mailing list