[Dshield] Increasing number of SQL_Slammer_Worm

Henderson, Henry Henry.Henderson at oa.mo.gov
Fri Aug 12 18:15:31 GMT 2005

In the last couple of days we have been seeing a increasing number of
SQL_Slammer_Worm attempts against our public sites.

A high number are from Asian countries, is anyone else seeing this.


Tag Name                                 Severity  Event Count Source
Count Target Count  Object Count     Earliest Event            Latest

SQL_SSRP_Slammer_Worm      High      2,124334           1440
12654               1          2005-08-10 07:00:00 CDT
2005-08-12 12:00:00 CDT


Time                                                     Tag Name
Event Count       Severity Source IP          Target IP           Object

2005-08-11 07:43:57 CDT           SQL_SSRP_Slammer_Worm      726
High  XXX.XXX192.162            1434

2005-08-11 09:54:45 CDT           SQL_SSRP_Slammer_Worm      722
High     XXX.XXX60.103              1434

2005-08-11 09:37:12 CDT           SQL_SSRP_Slammer_Worm      718
High  XXX.XXX209.153            1434

2005-08-11 10:03:49 CDT           SQL_SSRP_Slammer_Worm      718
High  XXX.XXX154.240            1434

2005-08-11 09:44:43 CDT           SQL_SSRP_Slammer_Worm      715
High  XXX.XXX51.122              1434

2005-08-11 09:36:11 CDT           SQL_SSRP_Slammer_Worm      714
High  XXX.XXX15.135              1434

2005-08-11 09:40:40 CDT           SQL_SSRP_Slammer_Worm      708
High  XXX.XXX67.67                1434

2005-08-11 07:57:43 CDT           SQL_SSRP_Slammer_Worm      707
High XXX.XXX149.25             1434

2005-08-11 09:48:02 CDT           SQL_SSRP_Slammer_Worm      705
High       XXX.XXX114.183            1434

2005-08-11 09:51:05 CDT           SQL_SSRP_Slammer_Worm      704
High  XXX.XXX158.203            1434

2005-08-11 09:38:13 CDT           SQL_SSRP_Slammer_Worm      703
High  XXX.XXX122.60              1434



Henry Henderson
Missouri Office of Administration
Information Technology Services Division
Information Security Managment Office


This e-mail and any attachments are intended only for those to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure and unauthorized use under applicable law.  If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender.  If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

More information about the list mailing list