[babayu]

以前用 Firewall 沒TDS與IDS 這次試用多了這個 有人知道這是什麼嗎

此次疾風事件病毒檢測方式就有提到IDS如下：


3、使用IDS系統檢測來自於網絡上的攻擊，IDS規則如下:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445
(msg:"NETBIOS SMB DCERPC ISystemActivator bind attempt"; flow:to_server,established;
content:"|FF|SMB|25|"; nocase; offset:4; depth:5; content:"|26 00|"; distance:56;
within:2; content:"|5c 00|P|00|I|00|P|00|E|00 5c 00|"; nocase; distance:5; within:12;
content:"|05|"; distance:0; within:1; content:"|0b|"; distance:1; within:1;
byte_test:1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46|";
distance:29; within:16; reference:cve,CAN-2003-0352asstype:
attempted-admin; sid:2193; rev:1

alert tcp $EXTERNAL_NET any -> $HOME_NET 135
(msg:"NETBIOS DCERPC ISystemActivator bind attempt"; flow:to_server,established;
content:"|05|"; distance:0; within:1; content:"|0b|"; distance:1; within:1; byte_test:
1,&,1,0,relative; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46|";
distance:29; within:16; reference:cve,CAN-2003-0352; classtype:attempted-admin;
sid:2192; rev:1