[logs] Event Log signature for SQL Server worm?

From: Tina Bird (tbird@precision-guesswork.com)
Date: Sat Jan 25 2003 - 20:20:52 PST

  • Next message: Rainer Gerhards: "[logs] Reliably detecting things like the SQL worm...."

    On Sat, 25 Jan 2003, Johannes Ullrich wrote:
    > oh well.. back to counting packets. BTW: Any idea what this worm looks
    > like in any MSFT application logs?
    So now that the feathers are settling -- anyone have Event Log data
    signatures of Sapphire/SQL Slammer, successful or otherwise?
    thanks -- tbird
    I, on the other hand, do not work. I enjoy the slothful life of an artist,
    and while away the hours in meaningless aesthetic pursuits punctuated by
    bouts of hedonistic debauchery and an occasional nap.
                                                  -- David Rinehart
    Log Analysis http://www.loganalysis.org
    VPN http://vpn.shmoo.com
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Sat Jan 25 2003 - 21:03:15 PST