Snort rules for "Sapphire" Worm

Sun Jan 26 00:12:28 UTC 2003

alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"HELL-SQL Worm
Scan";content:"|684765745466b96c6c|";classtype:attempted-admin;)
alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg: "SQLSLAMMER";
content:"dllhel32hkernQhounthickChGetTf"; classtype:bad-unknown;)
alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer Worm
Activity";content:"|04 01 01 01 01 01 01 01|"; classtype:bad-unknown;
sid:9994; rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 1434
(msg:"W32.SQLEXP.Wormpropagation"; content:"|68 2E 64 6C 6C 68 65 6C 33
32 68 6B 65 72 6E|";content:"|04|"; offset:0; depth:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"MS-SQL Slammer
WormActivity";content:"|81f10301049b81f101|"; classtype:bad-unknown;
sid:9994; rev:1;)

Swap external and home net to see both vectors
for this worm.

james