Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Is there any category for Snort rules that classifies them according to attcks such as U2R, R2L, .. ?!! Or how many well known attacks can it finds?!

share|improve this question

1 Answer

up vote 0 down vote accepted

All snort rules are categorised. Please see here - http://blog.snort.org/2012/03/rule-category-reorganization.html.

share|improve this answer
Yeah, for sure!! I just read it before, but i want to know these categories for some attacks like U2R, R2L, spoofing and etc. And also the old categories will be changed to protocols and files based!! but my question is that, Is there any category behind these categories for famous attacks or not?!! – Mohsen May 16 '12 at 18:25
So by U2R you're looking for privilege escalation type attacks, well they're system/application specific depending if either has a vulnerability and R2L equates to some sort of vulnerability that can be exploited to obtain local access via a remote exploit (I wouldn't call them famous). They're generic descriptions and you'll see Snort is (and will be) categorised based on protocol (vulnerabilities), types of client-side attacks (based on file types), policy or indicators (e.g. compromise). This evolution of categories will continue for quite a while from what I can see. – Mark Hillick May 16 '12 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.