[prev in list] [next in list] [prev in thread] [next in thread]
List: emerging-sigs
Subject: Re: [Emerging-Sigs] (no subject)
From: Darien Huss <dhuss () emergingthreats ! net>
Date: 2015-04-17 15:03:43
Message-ID: CAKcCgkVmZ3jherUr9in+G3K7pxf6mbXa5uvY_66YDziMo8a53g () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Seeing the same here:
http://cuckoo.killerinstinct.me/analysis/1194/
We're moving that sig and the other to Open today, thanks!
-Darien
On Fri, Apr 17, 2015 at 10:38 AM, Kevin Ross <kevross33@googlemail.com>
wrote:
> Hmmm.
>
> I didn't get any hits and I can certainly see why the ET TROJAN sig didn't
> fire when my machine generated the traffic on the sample. I tried running
> it against full sig set (including ETPRO) on another box and the only sig
> that fires is ETPRO TROJAN Win32/StreamFlaw.A Checkin.
>
> Kind Regards,
> Kevin
>
> On 17 April 2015 at 15:26, Darien Huss <dhuss@emergingthreats.net> wrote:
>
>> Whoops, sorry I wasn't more clear, by covered I meant at least some of
>> the traffic produced by this variant is covered by 2019881, so we don't
>> want to modify that one or it will miss what it was actually intended for.
>> Here is Suricata output from the referenced sample:
>>
>> 12/15/2014-11:37:29.133694 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1036 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:29.133694 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1036 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:38.309223 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1037 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:38.309223 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1037 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:19.389830 [**] [1:2809540:2] ETPRO TROJAN
>> Win32/StreamFlaw.A Checkin [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1034 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:54.257454 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:54.257454 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:56.319472 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:56.319472 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:40.128521 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1037 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:40.128521 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1037 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:24.391908 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1044 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:24.391908 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1044 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:27.125940 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1044 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:27.125940 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1044 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:58.712602 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:58.712602 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:59.461344 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:37:59.461344 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:01.139992 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:01.139992 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:04.546395 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:04.546395 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:25.380108 [**] [1:2019881:2] ET TROJAN Chthonic
>> Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1]
>> {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>> 12/15/2014-11:38:25.380108 [**] [1:2810059:5] ETPRO TROJAN
>> Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A Network Trojan was
>> detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> 62.76.xx.xx:80
>>
>> I'll move the PRO sigs over to OPEN, 2809540 is very similar to the rule
>> you suggested. If you have a pcap that doesn't have any hits at all (Pro or
>> Open) feel free to shoot it over off-list so I can take a look.
>>
>> Thanks!
>> Darien
>>
>> On Fri, Apr 17, 2015 at 10:09 AM, Kevin Ross <kevross33@googlemail.com>
>> wrote:
>>
>>> Hi,
>>>
>>> I think this sig needs modified. It never fired for me and looking it
>>> over I believe this negation is causing it to false negative. If you look
>>> at the second screenshot you see the HTTP beacons contain this header.
>>>
>>> content:!"Content-Type"; http_header;
>>>
>>>
>>> Kind Regards,
>>> Kevin Ross
>>>
>>> On 17 April 2015 at 14:20, Darien Huss <dhuss@emergingthreats.net>
>>> wrote:
>>>
>>>> Thanks Kevin, this is actually covered already by 2019881.
>>>>
>>>> Regards,
>>>> Darien
>>>>
>>>> On Fri, Apr 17, 2015 at 9:13 AM, Kevin Ross <kevross33@googlemail.com>
>>>> wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> A simple signature for this trojan. I am focusing on the fact it is
>>>>> Mozilla/6.0 fake UA which seems to be hardcoded.
>>>>>
>>>>> # Sample is mentioned in Fireeye Report
>>>>> alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN
>>>>> W32/Gamarue.AP CnC Beacon"; flow:established,to_server; urilen:1;
>>>>> content:"POST"; http_method; content:"/"; http_uri; depth:1;
>>>>> content:"User-Agent|3A| Mozilla/6.0 (compatible|3B| MSIE 6.0|3B| Windows NT
>>>>> 6.1)"; http_header; fast_pattern:21,20; content:!"Referer|3A|";
>>>>> http_header; classtype:trojan-activity; reference:url,
>>>>> www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html;
>>>>> reference:md5,04a35ce286644c9e0f994cc08210a5b4; sid:156711; rev:1;)
>>>>>
>>>>>
>>>>> Kind Regards,
>>>>> Kevin Ross
>>>>>
>>>>> _______________________________________________
>>>>> Emerging-sigs mailing list
>>>>> Emerging-sigs@lists.emergingthreats.net
>>>>> https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>>>>
>>>>> Support Emerging Threats! Subscribe to Emerging Threats Pro
>>>>> http://www.emergingthreats.net
>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>
[Attachment #5 (text/html)]
<div dir="ltr"><div><div>Seeing the same here:<br><br><a \
href="http://cuckoo.killerinstinct.me/analysis/1194/">http://cuckoo.killerinstinct.me/analysis/1194/</a><br><br></div>We're \
moving that sig and the other to Open today, \
thanks!<br><br></div>-Darien<br></div><div class="gmail_extra"><br><div \
class="gmail_quote">On Fri, Apr 17, 2015 at 10:38 AM, Kevin Ross <span \
dir="ltr"><<a href="mailto:kevross33@googlemail.com" \
target="_blank">kevross33@googlemail.com</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>Hmmm.<br><br>I didn't get any hits \
and I can certainly see why the ET TROJAN sig didn't fire when my machine \
generated the traffic on the sample. I tried running it against full sig set \
(including ETPRO) on another box and the only sig that fires is ETPRO TROJAN \
Win32/StreamFlaw.A Checkin.<br><br>Kind Regards,<br>Kevin<br></div></div><div \
class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div \
class="gmail_quote">On 17 April 2015 at 15:26, Darien Huss <span dir="ltr"><<a \
href="mailto:dhuss@emergingthreats.net" \
target="_blank">dhuss@emergingthreats.net</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div><div><div>Whoops, sorry I wasn't more \
clear, by covered I meant at least some of the traffic produced by this variant is \
covered by 2019881, so we don't want to modify that one or it will miss what it \
was actually intended for. Here is Suricata output from the referenced \
sample:<br><br>12/15/2014-11:37:29.133694 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1036 -> 62.76.xx.xx:80<br>12/15/2014-11:37:29.133694 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1036 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:38.309223 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1037 -> 62.76.xx.xx:80<br>12/15/2014-11:37:38.309223 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1037 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:19.389830 [**] [1:2809540:2] ETPRO TROJAN \
Win32/StreamFlaw.A Checkin [**] [Classification: A Network Trojan was detected] \
[Priority: 1] {TCP} 192.168.xx.xx:1034 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:54.257454 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:37:54.257454 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:56.319472 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:37:56.319472 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:40.128521 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1037 -> 62.76.xx.xx:80<br>12/15/2014-11:37:40.128521 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1037 -> \
62.76.xx.xx:80<br>12/15/2014-11:38:24.391908 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1044 -> 62.76.xx.xx:80<br>12/15/2014-11:38:24.391908 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1044 -> \
62.76.xx.xx:80<br>12/15/2014-11:38:27.125940 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1044 -> 62.76.xx.xx:80<br>12/15/2014-11:38:27.125940 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1044 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:58.712602 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:37:58.712602 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:37:59.461344 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:37:59.461344 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:38:01.139992 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:38:01.139992 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:38:04.546395 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:38:04.546395 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br>12/15/2014-11:38:25.380108 [**] [1:2019881:2] ET TROJAN Chthonic \
Check-in [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} \
192.168.xx.xx:1039 -> 62.76.xx.xx:80<br>12/15/2014-11:38:25.380108 [**] \
[1:2810059:5] ETPRO TROJAN Win32/Spy.Zbot.YW CnC Beacon [**] [Classification: A \
Network Trojan was detected] [Priority: 1] {TCP} 192.168.xx.xx:1039 -> \
62.76.xx.xx:80<br><br></div>I'll move the PRO sigs over to OPEN, 2809540 is very \
similar to the rule you suggested. If you have a pcap that doesn't have any hits \
at all (Pro or Open) feel free to shoot it over off-list so I can take a \
look.<br><br></div>Thanks!<span><font \
color="#888888"><br></font></span></div><span><font \
color="#888888">Darien<br></font></span></div><div><div><div \
class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 17, 2015 at 10:09 AM, \
Kevin Ross <span dir="ltr"><<a href="mailto:kevross33@googlemail.com" \
target="_blank">kevross33@googlemail.com</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div>Hi,<br><br>I think this sig needs \
modified. It never fired for me and looking it over I believe this negation is \
causing it to false negative. If you look at the second screenshot you see the HTTP \
beacons contain this header.<br><br>content:!"Content-Type"; \
http_header;<br><br><br>Kind Regards,<br>Kevin Ross<br></div></div><div><div><div \
class="gmail_extra"><br><div class="gmail_quote">On 17 April 2015 at 14:20, Darien \
Huss <span dir="ltr"><<a href="mailto:dhuss@emergingthreats.net" \
target="_blank">dhuss@emergingthreats.net</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex"><div dir="ltr"><div><div>Thanks Kevin, this is actually \
covered already by 2019881.<br><br></div>Regards,<br></div>Darien<br></div><div \
class="gmail_extra"><br><div class="gmail_quote"><div><div>On Fri, Apr 17, 2015 at \
9:13 AM, Kevin Ross <span dir="ltr"><<a href="mailto:kevross33@googlemail.com" \
target="_blank">kevross33@googlemail.com</a>></span> \
wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 \
.8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div \
dir="ltr"><div>Hi,<br><br>A simple signature for this trojan. I am focusing on the \
fact it is Mozilla/6.0 fake UA which seems to be hardcoded.<br><br># Sample is \
mentioned in Fireeye Report<br>alert http $HOME_NET any -> $EXTERNAL_NET any \
(msg:"ET TROJAN W32/Gamarue.AP CnC Beacon"; flow:established,to_server; \
urilen:1; content:"POST"; http_method; content:"/"; http_uri; \
depth:1; content:"User-Agent|3A| Mozilla/6.0 (compatible|3B| MSIE 6.0|3B| \
Windows NT 6.1)"; http_header; fast_pattern:21,20; \
content:!"Referer|3A|"; http_header; classtype:trojan-activity; \
reference:url,<a href="http://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html" \
target="_blank">www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html</a>; \
reference:md5,04a35ce286644c9e0f994cc08210a5b4; sid:156711; rev:1;)<br><br><br>Kind \
Regards,<br>Kevin Ross<br></div></div> \
<br></div></div>_______________________________________________<br> Emerging-sigs \
mailing list<br> <a href="mailto:Emerging-sigs@lists.emergingthreats.net" \
target="_blank">Emerging-sigs@lists.emergingthreats.net</a><br> <a \
href="https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs" \
target="_blank">https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs</a><br>
<br>
Support Emerging Threats! Subscribe to Emerging Threats Pro <a \
href="http://www.emergingthreats.net" \
target="_blank">http://www.emergingthreats.net</a><br> <br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
_______________________________________________
Emerging-sigs mailing list
Emerging-sigs@lists.emergingthreats.net
https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
Support Emerging Threats! Subscribe to Emerging Threats Pro http://www.emergingthreats.net
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic