Skip navigation.
Home

IDS sigs?

| |

Hi. New to the site, but this looks at lot like what some of my friends and I have been looking for. That is, a site that says something to the effect of "here is what a packet looks like if it (fill in the blank) and can be found with this signature."

I realize that sigs are better found at snort.org and sites like that, but it would be nice to have the full pcap file, the sig, *and* (if possible), the malware to go with it. Is that outside the scope of what this site is for? I notice that the Intrusion Detection links tells me to go away....

Thanks,

Wille

Malware Signatures

I tend to think that providing those sorts of malware PCAP files is beyond the scope of this site. What has been discussed, at least between Val and I, is attaching Snort signatures for specific worms to the thread. While this is by no means exhaustive, it could provide a starting place to search for you.

Just attach the snort signature to the comments of a specific piece of malware and that will make it available to everyone.

OpenPacket.org

Willie, a resource you might consider is OpenPacket.org I don't believe it is heavily developed yet but you can read about it and see if that might fit your needs a bit more.

I dont mind pcaps

I think pcaps are ok. I doubt we are able to grab pcaps for every piece of malware we come across (especially those that are not network aware) but if thats what the community wants to provide in comments thats great.

For some of the more interesting and timely worms I have no problem doing this, and in fact have stuck some stuff up already.

The signatures and malware samples are definately part of the scope and already here for the most part. We also often work with IDS and a/v community people behind the scenes to get this stuff out.

thanks for the feed back, keep it up!

V.

I've been providing SNORT

I've been providing SNORT sigs for things as I can . I've been out sick with our local bird flu variant , so as soon as the drugs wear off I'll get back on the horse and post more signatures.

" Fuck the fucking fuckers before they fuck you "
- The Rogue Warrior