Re: Snare - Windows ruleset for Prelude-LML

Hi Nicholas,

Le lundi 30 novembre 2009 à 12:42 -0600, Nicholas Nachefski a écrit :
> Here is the latest beta version of the Snare/Windows ruleset for use with
> Prelude-LML.  I've made the corrections recommended by the community and
> developers.  The Win 2003 rules are pretty stable and well tested, however,
> the 2008 ruleset will probably require further development.
> 
> Let me know if there are any other suggestions that you think i should
> consider.

Thanks for the update! 

I'm currently considering the ruleset for inclusion, there was a little
modification necessary to rules ID 99992 to prevent it from triggering a
warning on an invalid process PID.

Aditionally, is there any reason why IP address are matched using: 
(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(\S{4}\:\S{4}\:\S{4}\:\:\S{4}\:\S{4})?)

In place of the following, which should work both for IPv[46] :
(\S+)


Thank you very much for your work!

-- 
Yoann Vandoorselaere | Directeur Technique/CTO | PreludeIDS Technologies
Tel: +33 (0)1 40 24 65 10                      Fax: +33 (0)1 40 24 65 28
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user