Here is an example signature converted from a proposed Snort signature that supposedly fires on the Bugbear worm. It has not been tested. Nor will it be supported or included in a signature update. It may false positive and cause a performance hit on your sensors.
Also, we did release a signature for the BugBear backdoor port in S33. It was a miscommunication that we would not create a signature for that. However, we do not generally write signatures for email born virues like BugBear itself. We believe that anti-virus is the best solution for mitigating these kinds of problems.
___________________________________________________________________________
Current Signature: Engine ATOMIC.TCP SIGID 20000
SigName: Bugbear Worm
___________________________________________________________________________
0 - Edit ALL Parameters
1 - AlarmInterval =
2 - AlarmThrottle = FireOnce
3 - ChokeThreshold = 100
4 - DstPort = 25
5 - FlipAddr =
6 - LimitSummary =
7 * Mask = PSH ACK
8 - MaxInspectLength =
9 - MinHits =
10 - PortRange =
11 - ResetAfterIdle = 15
12 - SigComment =
13 - SigName = Bugbear Worm
14 - SigStringInfo =
15 - SinglePacketRegex =
uv+LRCQID7dIDFEECggDSLm9df8C/zSNKDBBAAoGA0AEUQ+FEN23f7doqAT/dCQ
16 - SourcePorts =
17 - SrcPort =
18 * StorageKey = SRC
19 * TcpFlags = PSH ACK
20 - ThrottleInterval = 30
21 - WantFrag =
d - Delete a value
u - UNDO and continue
x - SAVE and continue
___________________________________________________________________________
