[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    Re: [Snort-sigs] Info on 26266-26271?
From:       Nick Randolph <drandolph () sourcefire ! com>
Date:       2013-04-19 14:32:02
Message-ID: CACkSYkZ4ogvr8F-AWoptV5169jjMSDHvsr1dFjJursj5=wOVkg () mail ! gmail ! com
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


They look for domains that have been generated using the domain generation
algorithm implemented in Zeus.


On Fri, Apr 19, 2013 at 10:23 AM, Klein, Michael
<Michael.Klein@state.sd.us>wrote:

>  All, looking for a bit of information regarding signatures 26266 – 26271.
> ****
>
> ** **
>
> Wondering if there’s some documentation, or maybe a breakdown of what
> exactly this is looking for, as the rules are fairly beefy!****
>
> ** **
>
> Mike****
>
>
> ------------------------------------------------------------------------------
> Precog is a next-generation analytics platform capable of advanced
> analytics on semi-structured data. The platform includes APIs for building
> apps and a phenomenal toolset for data science. Developers can use
> our toolset for easy data analysis & visualization. Get a free account!
> http://www2.precog.com/precogplatform/slashdotnewsletter
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> http://www.snort.org
>
>
> Please visit http://blog.snort.org for the latest news about Snort!
>



-- 

Nick Randolph
Research Engineer
Sourcefire, Inc.
nrandolph@sourcefire.com
Sourcefire.com <http://www.sourcefire.com/>

[Attachment #5 (text/html)]

<div dir="ltr">They look for domains that have been generated using the domain \
generation algorithm implemented in Zeus.<br></div><div \
class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Apr 19, 2013 at 10:23 \
AM, Klein, Michael <span dir="ltr">&lt;<a href="mailto:Michael.Klein@state.sd.us" \
target="_blank">Michael.Klein@state.sd.us</a>&gt;</span> wrote:<br> <blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">





<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">All, looking for a bit of information regarding signatures <a \
href="tel:26266%20%E2%80%93%2026271" value="+12626626271" target="_blank">26266 – \
26271</a>. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Wondering if there’s some documentation, or maybe a breakdown of \
what exactly this is looking for, as the rules are fairly beefy!<u></u><u></u></p> <p \
class="MsoNormal"><u></u> <u></u></p> <p class="MsoNormal">Mike<u></u><u></u></p>
</div>
</div>

<br>------------------------------------------------------------------------------<br>
 Precog is a next-generation analytics platform capable of advanced<br>
analytics on semi-structured data. The platform includes APIs for building<br>
apps and a phenomenal toolset for data science. Developers can use<br>
our toolset for easy data analysis &amp; visualization. Get a free account!<br>
<a href="http://www2.precog.com/precogplatform/slashdotnewsletter" \
target="_blank">http://www2.precog.com/precogplatform/slashdotnewsletter</a><br>_______________________________________________<br>
 Snort-sigs mailing list<br>
<a href="mailto:Snort-sigs@lists.sourceforge.net">Snort-sigs@lists.sourceforge.net</a><br>
 <a href="https://lists.sourceforge.net/lists/listinfo/snort-sigs" \
target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-sigs</a><br> <a \
href="http://www.snort.org" target="_blank">http://www.snort.org</a><br> <br>
<br>
Please visit <a href="http://blog.snort.org" \
target="_blank">http://blog.snort.org</a> for the latest news about \
Snort!<br></blockquote></div><br><br clear="all"><br>-- <br><br>Nick \
Randolph<br>Research Engineer<br>Sourcefire, Inc.<br> <a \
href="mailto:nrandolph@sourcefire.com" \
target="_blank">nrandolph@sourcefire.com</a><br><a href="http://www.sourcefire.com/" \
style="color:rgb(17,85,204)" target="_blank">Sourcefire.com</a> </div>



------------------------------------------------------------------------------
Precog is a next-generation analytics platform capable of advanced
analytics on semi-structured data. The platform includes APIs for building
apps and a phenomenal toolset for data science. Developers can use
our toolset for easy data analysis & visualization. Get a free account!
http://www2.precog.com/precogplatform/slashdotnewsletter

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!

[prev in list] [next in list] [prev in thread] [next in thread]