Snort

Sourcefire VRT Rules Update

Date: 2009-01-13

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.8.

The format of the file is:

sid - Message (rule group, priority)

New rules:
    15227 <-> NETBIOS-DG SMB Trans2 OPEN2 unicode andx param_count underflow attempt (netbios.rules)
    15226 <-> NETBIOS-DG SMB Trans2 OPEN2 andx param_count underflow attempt (netbios.rules)
    15225 <-> NETBIOS SMB Trans2 OPEN2 andx param_count underflow attempt (netbios.rules)
    15224 <-> NETBIOS SMB Trans2 OPEN2 unicode andx param_count underflow attempt (netbios.rules)
    15223 <-> NETBIOS-DG SMB Trans2 OPEN2 unicode param_count underflow attempt (netbios.rules)
    15222 <-> NETBIOS-DG SMB Trans2 OPEN2 param_count underflow attempt (netbios.rules)
    15221 <-> NETBIOS SMB Trans2 OPEN2 param_count underflow attempt (netbios.rules)
    15220 <-> NETBIOS SMB Trans2 OPEN2 unicode param_count underflow attempt (netbios.rules)
    15219 <-> NETBIOS-DG SMB Trans2 OPEN2 unicode andx max_param_count underflow attempt (netbios.rules)
    15218 <-> NETBIOS SMB Trans2 OPEN2 andx max_param_count underflow attempt (netbios.rules)
    15217 <-> NETBIOS SMB Trans2 OPEN2 unicode andx max_param_count underflow attempt (netbios.rules)
    15216 <-> NETBIOS-DG SMB Trans2 OPEN2 andx max_param_count underflow attempt (netbios.rules)
    15215 <-> NETBIOS-DG SMB Trans2 OPEN2 unicode max_param_count underflow attempt (netbios.rules)
    15214 <-> NETBIOS SMB Trans2 OPEN2 max_param_count underflow attempt (netbios.rules)
    15213 <-> NETBIOS SMB Trans2 OPEN2 unicode max_param_count underflow attempt (netbios.rules)
    15212 <-> NETBIOS-DG SMB Trans2 OPEN2 max_param_count underflow attempt (netbios.rules)
    15211 <-> NETBIOS-DG SMB NT Trans NT CREATE andx max_param_count underflow attempt (netbios.rules)
    15210 <-> NETBIOS SMB NT Trans NT CREATE andx max_param_count underflow attempt (netbios.rules)
    15209 <-> NETBIOS SMB NT Trans NT CREATE unicode andx max_param_count underflow attempt (netbios.rules)
    15208 <-> NETBIOS-DG SMB NT Trans NT CREATE unicode andx max_param_count underflow attempt (netbios.rules)
    15207 <-> NETBIOS-DG SMB NT Trans NT CREATE max_param_count underflow attempt (netbios.rules)
    15206 <-> NETBIOS SMB NT Trans NT CREATE max_param_count underflow attempt (netbios.rules)
    15205 <-> NETBIOS SMB NT Trans NT CREATE unicode max_param_count underflow attempt (netbios.rules)
    15204 <-> NETBIOS-DG SMB NT Trans NT CREATE unicode max_param_count underflow attempt (netbios.rules)
    15203 <-> NETBIOS SMB NT Trans NT CREATE andx param_count underflow attempt (netbios.rules)
    15202 <-> NETBIOS-DG SMB NT Trans NT CREATE unicode andx param_count underflow attempt (netbios.rules)
    15201 <-> NETBIOS-DG SMB NT Trans NT CREATE andx param_count underflow attempt (netbios.rules)
    15200 <-> NETBIOS SMB NT Trans NT CREATE unicode andx param_count underflow attempt (netbios.rules)
    15199 <-> NETBIOS SMB NT Trans NT CREATE param_count underflow attempt (netbios.rules)
    15198 <-> NETBIOS-DG SMB NT Trans NT CREATE unicode param_count underflow attempt (netbios.rules)
    15197 <-> NETBIOS-DG SMB NT Trans NT CREATE param_count underflow attempt (netbios.rules)
    15196 <-> NETBIOS SMB NT Trans NT CREATE unicode param_count underflow attempt (netbios.rules)