On Mon, Jan 05, 2004 at 02:17:23PM +0100, Petar Jurkovi=C4=87 wrote:
> Experimental rule for Exploit-ByteVerify.
>=20
> =20
>=20
> winter tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Exploit-Byt=
eVerify beyond.class"; content:"|74 74 70 3a 2f 2f 36 36 2e 32 33 30 2e 3=
1 33 34 2e 31 35 30|";)
Uh... so why not...=20
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (content:"ttp\://66.=
230.134.150";)
According to data released by Symantec about this trojan, the trojan
connects to http://www.clavus.net, not an IP address. While they have been
wrong in the past, but they are usually right on when it comes to
trojans.
-brian
|
