RE: Assessing Your Malware Exposure with Snort

and without going to www.kgb.to 
(interesting domain) which doesn't match your 
email domain ... 

how do we know that kgb.to isnt evil... 

ah the paradox... 

kenneth gf brown 
ceo shadowplay.net


> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of 
> [email protected]
> Sent: February 15, 2005 10:39
> To: [email protected]
> Subject: [Intrusions] Assessing Your Malware Exposure with Snort
> 
> 
> I have written a few thousand Snort rules that are intended 
> to detect successful HTTP communication with hosts known to 
> be evil. They look for domain names in the Host string so 
> they are not subject to evasion by changing IP addresses.
> 
> If you would like to give them a try you can grab them from 
> http://www.kgb.to/malware.html .
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> *******************    N O T I C E    *******************
> The information contained in this e-mail, and in any 
> accompanying documents, may constitute confidential and/or 
> legally privileged information.  The information is intended 
> only for use by the designated recipient.  If you are not the 
> intended recipient (or responsible for the delivery of the 
> message to the intended recipient), you are hereby notified 
> that any dissemination, distribution, copying, or other use 
> of, or taking of any action in reliance on this e-mail is 
> strictly prohibited.  If you have received this e-mail 
> communication in error, please notify the sender immediately 
> and delete the message from your system.
> ***************************************************
> 
> _______________________________________________
> Intrusions mailing list
> [email protected] 
> http://www.dshield.org/mailman/listinfo/intrusions
> 
> 
> __________ NOD32 1.1002 (20050218) Information __________
> 
> This message was checked by NOD32 antivirus system. 
> http://www.nod32.com
> 
> 

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions