Jan Wrobel wrote:
> I don't know if this rule detects all possible exploits or just one
> particular type. Here is a Firekeeper version of the rule, which can
> be used to detect sites hosting malicious files:
>
> alert (msg:"BLEEDING-EDGE CURRENT EVENTS MS ANI exploit"; body_content:"|54 53 49 4C ...
> I don't know if this rule detects all possible exploits or just one
> particular type. Here is a Firekeeper version of the rule, which can
> be used to detect sites hosting malicious files:
>
> alert (msg:"BLEEDING-EDGE CURRENT EVENTS MS ANI exploit"; body_content:"|54 53 49 4C ...
[ more ]