Welcome, Guest! Log In | Create Account

SourceForge.net > Projects > Snort > Mail > Archive

Snort

Email Archive: snort-sigs (read-only)

2000:	_Jan	_Feb	_Mar	_Apr	_May	_Jun	_Jul	_Aug	_Sep	_Oct (13)	_Nov (6)	_Dec (8)
2001:	_Jan (4)	_Feb (1)	_Mar (3)	_Apr (6)	_May (4)	_Jun (7)	_Jul (26)	_Aug (24)	_Sep (45)	_Oct (43)	_Nov (49)	_Dec (32)
2002:	_Jan (165)	_Feb (87)	_Mar (148)	_Apr (131)	_May (87)	_Jun (93)	_Jul (150)	_Aug (119)	_Sep (151)	_Oct (113)	_Nov (148)	_Dec (64)
2003:	_Jan (157)	_Feb (152)	_Mar (177)	_Apr (178)	_May (125)	_Jun (322)	_Jul (237)	_Aug (133)	_Sep (122)	_Oct (146)	_Nov (94)	_Dec (118)
2004:	_Jan (152)	_Feb (138)	_Mar (124)	_Apr (137)	_May (155)	_Jun (219)	_Jul (343)	_Aug (287)	_Sep (166)	_Oct (210)	_Nov (129)	_Dec (153)
2005:	_Jan (123)	_Feb (98)	_Mar (139)	_Apr (83)	_May (108)	_Jun (113)	_Jul (107)	_Aug (72)	_Sep (97)	_Oct (92)	_Nov (80)	_Dec (67)
2006:	_Jan (59)	_Feb (64)	_Mar (50)	_Apr (54)	_May (50)	_Jun (40)	_Jul (58)	_Aug (52)	_Sep (27)	_Oct (48)	_Nov (46)	_Dec (32)
2007:	_Jan (49)	_Feb (50)	_Mar (39)	_Apr (50)	_May (42)	_Jun (62)	_Jul (74)	_Aug (35)	_Sep (40)	_Oct (33)	_Nov (28)	_Dec (47)
2008:	_Jan (42)	_Feb (69)	_Mar (48)	_Apr (54)	_May (13)	_Jun (8)	_Jul (16)	_Aug (13)	_Sep (10)	_Oct (12)	_Nov (12)	_Dec (27)
2009:	_Jan (9)	_Feb (11)	_Mar (7)	_Apr (25)	_May (11)	_Jun (6)	_Jul (45)	_Aug (8)	_Sep (16)	_Oct (9)	_Nov (69)	_Dec (92)
2010:	_Jan (88)	_Feb (24)	_Mar	_Apr	_May	_Jun	_Jul	_Aug	_Sep	_Oct	_Nov	_Dec


S	M	T	W	T	F	S
1	2	3	4	5	6	7
	(1)	(2)	(3)	(1)	(1)	(1)
8	9	10	11	12	13	14
			(3)
15	16	17	18	19	20	21
(2)		(1)	(2)	(3)	(4)	(2)
22	23	24	25	26	27	28
	(2)	(2)		(2)	(5)	(2)
29	30	31
		(9)

[Snort-sigs] Dynamic DNS update attempt (new sig)

From: Jon Hart <jhart@sp...> - 2006-10-31 22:41

The signature below *should* alert on attempts to do Dynamic DNS
updates (not in the dyndns.org/etc sense). It does this by looking for
an opcode of 5 (update), followed by 1 or more zones to update, followed
by 0 or more -reqs, followed by 1 or more updates, followed by
0 or more additional RRs, followed by some amount of data that should
contain the actual updates.

I'm not too good with byte_test, but in my testing this seems to work as
desired. The isdataat value was picked out of the air -- suggestions
are welcome.

I plan on using this sig on our internal and external DNS -- DNS updates
internally have bit us in the past, so hopefully this sig helps someone
else too.

Comments, complaints, etc, are welcome.

alert udp $EXTERNAL_NET any -> $DNS_SERVERS 53 (msg:"DNS Dynamic update
attempt"; byte_test:2,&,10240,2; byte_test:2,>,0,0,relative;
byte_test:2,^,1,0,relative; byte_test:2,>,0,0,relative;
byte_test:2,^,1,0,relative; isdataat:20,relative; sid:11111111; rev:1;)

-jon

[Snort-sigs] new rule for detect windows NAT DNS DoS

From: rmkml <rmkml@fr...> - 2006-10-31 08:14

Hi,

please check and maybe add this new rule :

dns.rules:alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS Windows
NAT DoS attempt"; content:"|01 00|"; offset:2; content:"|00 00|";
offset:10; reference:cve,2006-5614; classtype:bad-unknown; rev:1;)

"Overview: Microsoft Windows NAT Helper components (ipnathlp.dll) on
windows XP SP2, when internet connection sharing is enabled, allows remote
attackers to cause DoS (svchost.exe crash) via malformed DNS query, which
results in a null pointer dereference."

Any suggestions and improvements are welcome,

This rule is offered by Crusoe Researches (Team)
http://www.crusoe-researches.com

Regards
Rmkml

Re: [Snort-sigs] new rule for detect windows NAT DNS DoS

From: Blake Hartstein <bhartstein@de...> - 2006-10-31 16:01

My data shows this also valid over tcp.
This rule is too generic, I tested it with a large amount of DNS traffic
and legitimate requests cause false positives very frequently, namely:

The header field "Questions" has a value of 00 01
And the data following contains multiple null bytes.

Is there a better way to anchor this detection?

-Blake

rmkml wrote:
> Hi,
>
> please check and maybe add this new rule :
>
> dns.rules:alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS Windows
> NAT DoS attempt"; content:"|01 00|"; offset:2; content:"|00 00|";
> offset:10; reference:cve,2006-5614; classtype:bad-unknown; rev:1;)
>
> "Overview: Microsoft Windows NAT Helper components (ipnathlp.dll) on
> windows XP SP2, when internet connection sharing is enabled, allows remote
> attackers to cause DoS (svchost.exe crash) via malformed DNS query, which
> results in a null pointer dereference."
>
> Any suggestions and improvements are welcome,
>
> This rule is offered by Crusoe Researches (Team)
> http://www.crusoe-researches.com
>
> Regards
> Rmkml
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with -integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>

--
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain information that is confidential and privileged. If you receive this email in error, please advise us by return email immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately. Demarc Security, Inc. does not accept liability for the views exssed in the email or for the consequences of any computer viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written consent of the copyright owner.

Re: [Snort-sigs] new rule for detect windows NAT DNS DoS

From: M. Shirk <shirkdog_list@ho...> - 2006-10-31 16:22

This is what I had.

Its the Query, with the other values set to null.

alert tcp $HOME_NET any -> any 53 (msg:"DNS Goes bad on Windows";
content:"|01 00|"; offset: 2; byte_test:8,=,0,0,relative; rev:1; sid:666; )

Shirkdog
http://www.shirkdog.us

>From: Blake Hartstein <bhartstein@demarc.com>
>To: rmkml <rmkml@free.fr>
>CC: Snort-sigs@lists.sourceforge.net /> >Subject: Re: [Snort-sigs] new rule for detect windows NAT DNS DoS
>Date: Tue, 31 Oct 2006 08:01:26 -0800
>
>My data shows this also valid over tcp.
>This rule is too generic, I tested it with a large amount of DNS traffic
>and legitimate requests cause false positives very frequently, namely:
>
>The header field "Questions" has a value of 00 01
>And the data following contains multiple null bytes.
>
>Is there a better way to anchor this detection?
>
>-Blake
>
>
>rmkml wrote:
> > Hi,
> >
> > please check and maybe add this new rule :
> >
> > dns.rules:alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS Windows
> > NAT DoS attempt"; content:"|01 00|"; offset:2; content:"|00 00|";
> > offset:10; reference:cve,2006-5614; classtype:bad-unknown; rev:1;)
> >
> > "Overview: Microsoft Windows NAT Helper components (ipnathlp.dll) on
> > windows XP SP2, when internet connection sharing is enabled, allows
>remote
> > attackers to cause DoS (svchost.exe crash) via malformed DNS query,
>which
> > results in a null pointer dereference."
> >
> > Any suggestions and improvements are welcome,
> >
> > This rule is offered by Crusoe Researches (Team)
> > http://www.crusoe-researches.com
> >
> > Regards
> > Rmkml
> >
> >
>-------------------------------------------------------------------------
> > Using Tomcat but need to do more? Need to support web services,
>security?
> > Get stuff done quickly with -integrated technology to make your job
>easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache
>Geronimo
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs@lists.sourceforge.net /> > > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> >
>
>
>--
>This email and any files transmitted with it are solely intended for the
>use of the addressee(s) and may contain information that is confidential
>and privileged. If you receive this email in error, please advise us by
>return email immediately. Please also disregard the contents of the email,
>delete it and destroy any copies immediately. Demarc Security, Inc. does
>not accept liability for the views exssed in the email or for the
>consequences of any computer viruses that may be transmitted with this
>email.
>
>This email is also subject to copyright. No part of it should be
>reproduced, adapted or transmitted without the written consent of the
>copyright owner.
>
>
>-------------------------------------------------------------------------
>Using Tomcat but need to do more? Need to support web services, security?
>Get stuff done quickly with -integrated technology to make your job
>easier
>Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>_______________________________________________
>Snort-sigs mailing list
>Snort-sigs@lists.sourceforge.net /> >https://lists.sourceforge.net/lists/listinfo/snort-sigs

_________________________________________________________________
Stay in touch with old friends and meet new ones with Windows Live Spaces
http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

Re: [Snort-sigs] new rule for detect windows NAT DNS DoS

From: Frank Knobbe <frank@kn...> - 2006-10-31 19:32

Attachments: Message as HTML

On Tue, 2006-10-31 at 11:22 -0500, M. Shirk wrote:
> This is what I had.
> Its the Query, with the other values set to null.
>=20
> alert tcp $HOME_NET any -> any 53 (msg:"DNS Goes bad on Windows";=20
> content:"|01 00|"; offset: 2; byte_test:8,=3D,0,0,relative; rev:1; sid:66=
6; )

Looks identical, except using byte_test instead of a second content.
That should be FP'ing a lot too, or not?

-Frank

--=20
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Re: [Snort-sigs] new rule for detect windows NAT DNS DoS

From: Frank Knobbe <frank@kn...> - 2006-10-31 20:10

Attachments: Message as HTML

On Tue, 2006-10-31 at 13:32 -0600, Frank Knobbe wrote:
> On Tue, 2006-10-31 at 11:22 -0500, M. Shirk wrote:
> > This is what I had.
> > Its the Query, with the other values set to null.
> >=20
> > alert tcp $HOME_NET any -> any 53 (msg:"DNS Goes bad on Windows";=20
> > content:"|01 00|"; offset: 2; byte_test:8,=3D,0,0,relative; rev:1; sid:=
666; )
>=20
> Looks identical, except using byte_test instead of a second content.

Or not.... never mind. /me rubs eyes

-Frank

--=20
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Re: [Snort-sigs] new rule for detect windows NAT DNS DoS

From: Brian <bmc@sn...> - 2006-10-31 21:06

On Tue, Oct 31, 2006 at 11:22:08AM -0500, M. Shirk wrote:
> This is what I had.
>
> Its the Query, with the other values set to null.
>
> alert tcp $HOME_NET any -> any 53 (msg:"DNS Goes bad on Windows";
> content:"|01 00|"; offset: 2; byte_test:8,=,0,0,relative; rev:1; sid:666; )

commentary:
- using content where you should be using byte_test
- using byte_test where you should be using content
- even if byte_test was the correct rule option for the data it is
being used to compare against (which it isn't), byte_test can only read
up to 4 bytes of data. [0]

Fixup suggestions:
1) Check the single bit with byte_test
2) Check the 8 bytes of null with content

Brian

0 - string mode is different. but you are not using string mode, so
don't worry about it.

[Snort-sigs] Help

From: Chad Gross <cgross@lo...> - 2006-10-23 02:39

-----Original Message-----
From: snort-sigs-bounces@lists.sourceforge.net /> [mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of
snort-sigs-request@lists.sourceforge.net /> Sent: Thursday, October 19, 2006 7:49 AM
To: snort-sigs@lists.sourceforge.net /> Subject: Snort-sigs Digest, Vol 5, Issue 8

Send Snort-sigs mailing list submissions to
snort-sigs@lists.sourceforge.net />
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/snort-sigs
or, via email, send a message with subject or body 'help' to
snort-sigs-request@lists.sourceforge.net />
You can reach the person managing the list at
snort-sigs-owner@lists.sourceforge.net />
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-sigs digest..."

Today's Topics:

1. Sourcefire VRT Certified Rules Update (Sourcefire VRT)
2. False Positive (Adam Clinch)
3. False postive SID 7100 (East, Bill)
4. Bleeding Edge Threats Daily Update (bleeding@bleedingthreats.net) /> 5. Bleeding Edge Threats Daily Update (bleeding@bleedingthreats.net) /> 6. Error in oracle rule... (Jay 'Whip' Grizzard)

----------------------------------------------------------------------

Message: 1
Date: Wed, 18 Oct 2006 18:05:19 -0400
From: Sourcefire VRT <research@sourcefire.com>
Subject: [Snort-sigs] Sourcefire VRT Certified Rules Update
To: Snort Sigs <snort-sigs@lists.sourceforge.net>
Message-ID: <4536A51F.9020008@sourcefire.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sourcefire VRT Certified Rules Update

Synopsis:
The Sourcefire VRT has added multiple rules in the spyware-put and
backdoor categories to provide coverage for emerging spyware and trojan
horse threats. The VRT has also updated numerous rules in the FTP
category to accommodate larger default values for FTP services,
additionally reference information has been added and improved
throughout the VRT Certified Rule Set.

Details:
As a result of ongoing research, the Sourcefire VRT has added multiple
rules to the spyware and backdoor rule sets to provide coverage for
emerging threats from these technologies.

A number of rules in the FTP rule category have been updated to
accommodate larger default values in some FTP services.

The VRT has also updated and added reference information throughout the
entire Sourcefire VRT Certified Rule Set.

For a complete list of new and modified rules:

http://www.snort.org/rules/docs/ruleset_changelogs/changes-2006-10-18.ht
ml

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFFNqUfMpm0ve0NhMcRAv9SAJ0QLYKWSfVWR2vU0/azL4Bowa/iDQCgooOa
3PR6taVgZFnVslLJYSTYEaU=
=pGnz
-----END PGP SIGNATURE-----

------------------------------

Message: 2
Date: Fri, 29 Sep 2006 20:03:35 +1000
From: Adam Clinch <adam.clinch@gmail.com>
Subject: [Snort-sigs] False Positive
To: snort-sigs@lists.sourceforge.net /> Message-ID: <451CEF77.2040301@gmail.com>
Content-Type: text/plain; charset="iso-8859-1"

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#

Rule:
spyware-put.rules:alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"SPYWARE-PUT Adware hxdl runtime detection - crypt user-agent";
flow:to_server,established; content:"User-Agent|3A|"; nocase;
content:"CryptRetrieveObjectByUrl|3A 3A|InetSchemeProvider"; distance:0;
nocase;
pcre:"/^User-Agent\x3A[^\r\n]+CryptRetrieveObjectByUrl\x3A\x3AInetScheme
Provider/smi";
reference:url,www.spywareguide.com/product_show.php?id=516;
reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075079;
classtype:misc-activity; sid:7555; rev:1;)

--
Sid:
7555
--
Summary:
This event is generated when activity relating to a spyware application
is detected.
--
Impact:
Unkown. Possible information disclosure, violation of privacy, possible
violation of policy.
--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:
Triggers on crl.microsoft.com

source addr dest addr Ver Hdr Len TOS length
ID flags
offset TTL chksum
147.10.195.135
<http://192.168.0.254/acid/acid_stat_ipaddr.php?ip=147.10.195.135&netmas
k=32>
131.107.115.28
<http://192.168.0.254/acid/acid_stat_ipaddr.php?ip=131.107.115.28&netmas
k=32>
4 5 0 461 15547 0 0 64
44886

000 : 47 45 54 20 2F 70 6B 69 2F 63 72 6C 2F 70 72 6F GET /pki/crl/pro
010 : 64 75 63 74 73 2F 43 6F 64 65 53 69 67 6E 50 43 ducts/CodeSignPC
020 : 41 2E 63 72 6C 20 48 54 54 50 2F 31 2E 30 0D 0A A.crl HTTP/1.0..
030 : 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 55 73 65 Accept: */*..Use
040 : 72 2D 41 67 65 6E 74 3A 20 43 72 79 70 74 52 65 r-Agent: CryptRe
050 : 74 72 69 65 76 65 4F 62 6A 65 63 74 42 79 55 72 trieveObjectByUr
060 : 6C 3A 3A 49 6E 65 74 53 63 68 65 6D 65 50 72 6F l::InetSchemePro
070 : 76 69 64 65 72 0D 0A 48 6F 73 74 3A 20 63 72 6C vider..Host: crl
080 : 2E 6D 69 63 72 6F 73 6F 66 74 2E 63 6F 6D 0D 0A .microsoft.com..
090 : 43 6F 6F 6B 69 65 3A 20 73 5F 6E 72 3D 31 31 35 Cookie: s_nr=115
0a0 : 38 39 38 38 31 37 36 35 35 30 3B 20 57 54 5F 46 8988176550; WT_F
0b0 : 50 43 3D 69 64 3D 31 34 37 2E 31 30 2E 31 39 35 PC=id=147.10.195
0c0 : 2E 31 33 35 2D 31 31 33 34 36 37 32 31 31 32 2E .135-1134672112.
0d0 : 32 39 38 31 30 33 37 38 3A 6C 76 3D 31 31 35 38 29810378:lv=1158
0e0 : 39 32 33 33 35 37 38 32 30 3A 73 73 3D 31 31 35 923357820:ss=115
0f0 : 38 39 35 32 31 30 35 39 31 30 3B 20 4D 43 31 3D 8952105910; MC1=
100 : 47 55 49 44 3D 39 30 62 34 38 64 36 39 61 63 64 GUID=90b48d69acd
110 : 66 32 65 34 64 61 39 34 61 63 38 63 66 32 33 34 f2e4da94ac8cf234
120 : 61 62 33 61 39 26 48 41 53 48 3D 36 39 38 64 26 ab3a9&HASH=698d&
130 : 4C 56 3D 32 30 30 36 39 26 56 3D 33 3B 20 41 3D LV=20069&V=3; A=
140 : 49 26 49 3D 41 78 55 46 41 41 41 41 41 41 43 57 I&I=AxUFAAAAAACW
150 : 42 77 41 41 7A 53 39 42 54 35 4A 4A 2B 39 6A 34 BwAAzS9BT5JJ+9j4
160 : 36 46 75 6C 6A 58 30 65 74 67 21 21 0D 0A 43 61 6FuljX0etg!!..Ca
170 : 63 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D che-Control: no-
180 : 63 61 63 68 65 2C 20 6D 61 78 2D 61 67 65 3D 32 cache, max-age=2
190 : 35 39 32 30 30 0D 0A 0D 0A 59200....

--
False Negatives:

--
Corrective Action:

--
Contributors:

--
Additional References:

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://sourceforge.net/mailarchive/forum.php?forum=snort-sigs/attachment
s/20060929/d1c0cb57/attachment.html

------------------------------

Message: 3
Date: Wed, 4 Oct 2006 09:51:50 -0400
From: "East, Bill" <eastb@PFFCU.org>
Subject: [Snort-sigs] False postive SID 7100
To: <snort-sigs@lists.sourceforge.net>
Message-ID:
<DB70207C75570343BD590F95BA86ADBC010D15E9@ccex0505.pffcu.org>

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#

Rule: BACKDOOR mass connect 1.1 runtime detection - http

--
Sid: 7100

--
Summary:

--
Impact:

--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives: Numara Software, makers of TrackIt! audit software,
also use the UtilMind useragent to pull down content. This is sufficient
to trigger the rule.

--
False Negatives:

--
Corrective Action:

--
Contributors:

--
Additional References:

------------------------------

Message: 4
Date: Tue, 17 Oct 2006 21:00:10 -0400 (EDT)
From: bleeding@bleedingthreats.net /> Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
To: snort-sigs@lists.sourceforge.net /> Message-ID: <20061018010010.65F1A5502A1@gort.offsitefilter.com>
Content-Type: text/plain

[***] Results from Oinkmaster started Tue Oct 17 21:00:10 2006 [***]

[+++] Added rules: [+++]

2003118 - BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai polymorphic
payload (bleeding-virus.rules)
2003119 - BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic payload
(bleeding-virus.rules)
2003120 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
(bleeding-policy.rules)
2003121 - BLEEDING-EDGE docs.google.com Activity
(bleeding-policy.rules)
2003122 - BLEEDING-EDGE Possible docs.google.com Activity
(bleeding-policy.rules)

[///] Modified active rules: [///]

2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)

[---] Removed rules: [---]

2003118 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
(bleeding-policy.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-policy.rules (1):
# Submitted 2006-10-17 by Adam Nunn

-> Added to bleeding-sid-msg.map (5):
2003118 || BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai
polymorphic payload || url,toorcon.org/2006/conference.html?id=29
2003119 || BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic
payload || url,toorcon.org/2006/conference.html?id=29
2003120 || BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
2003121 || BLEEDING-EDGE docs.google.com Activity ||
url,docs.google.com
2003122 || BLEEDING-EDGE Possible docs.google.com Activity ||
url,docs.google.com

[---] Removed non-rule lines: [---]

-> Removed from bleeding-sid-msg.map (1):
2003118 || BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)

-> Removed from bleeding-virus.rules (2):
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE
VIRUS SHELLCODE Shikata Ga Nai polymorphic payload";
classtype:shellcode-detect; dsize: >26; content: "|d9 74 24 f4|"; pcre:
"/[\x29\x2b\x31\x33]\xc9/sm"; pcre:
"/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-\x5f]/s
m"; pcre:
"/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^\x00\
xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^\x00]
[^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43\x46\x
47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\
xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc][\x03\
x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x
78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c\x0e
-\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|([\x29\x2b\x31\x33
\xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^\x00][^
\x00][^\x00][^\x00][\x24\

xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf\xd9]
[^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x5
8\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\
xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc][\x03\x3
1\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\
x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb
\xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003118;
rev:1;)
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE
VIRUS SHELLCODE ADMutate polymorphic payload";
classtype:shellcode-detect; dsize: >45; content: "|e8|"; content: "|ff
ff ff|"; distance: 1; within: 3; pcre:
"/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83\xec
\x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0\x91))|((\
x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|\x6a.
\x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b\x06\x0
9\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0
,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x
96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].{0,20}\
xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003119;
rev:1;)

------------------------------

Message: 5
Date: Wed, 18 Oct 2006 21:00:09 -0400 (EDT)
From: bleeding@bleedingthreats.net /> Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
To: snort-sigs@lists.sourceforge.net /> Message-ID: <20061019010009.474F155026A@gort.offsitefilter.com>
Content-Type: text/plain

[***] Results from Oinkmaster started Wed Oct 18 21:00:07 2006 [***]

[///] Modified active rules: [///]

2001850 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
Requested (1) (bleeding-malware.rules)
2002093 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
Requested (2) (bleeding-malware.rules)
2002697 - BLEEDING-EDGE EXPLOIT CVSTrac filediff Arbitrary Remote Code
Execution (bleeding-exploit.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING
SOURCE (bleeding-botcc-BLOCK.rules)

[///] Modified inactive rules: [///]

2002692 - BLEEDING-EDGE CURRENT EVENTS Bagle.Gen HTTP Get Traffic -
Possible Infected Host (bleeding.rules)

[*] Non-rule line modifications: [*]
None.

------------------------------

Message: 6
Date: Fri, 22 Sep 2006 15:57:43 -0700
From: Jay 'Whip' Grizzard <elfchief@lupine.org>
Subject: [Snort-sigs] Error in oracle rule...
To: snort-sigs@lists.sourceforge.net /> Message-ID: <20060922225743.GK7734@zash.lupine.org>
Content-Type: text/plain; charset=us-ascii

I'm not certain where the right place to send bug reports in rules to
is,
and haven't been able to find specific data, so I'll try here.

I think that the oracle 'user name buffer overflow attempt' rule (sid
2650)
is wrong and does not check for the correct string.

It currently reads (relevant snippet):

content:"|28|user="; nocase; isdataat:1000,relative; content:!"|22|";
within:1000

0x28 = (
0x22 = "

... which is basically saying to match on the string "(user=" if there's
not
a quote within the next thousand characters.

What I think it's *supposed* to do is to match if there's not a closing
parenthesis within the next thousand characters, since the string used
in actual requests is "(user=<username>)".

So I think the rule should actually be (again, relevant snippet):

content:"|28|user="; nocase; isdataat:1000,relative; content:!"|29|";
within:1000

Thanks for your attention.

-jay

------------------------------

------------------------------------------------------------------------
-
Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with -integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net /> https://lists.sourceforge.net/lists/listinfo/snort-sigs

End of Snort-sigs Digest, Vol 5, Issue 8
****************************************

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.408 / Virus Database: 268.13.5/485 - Release Date:
10/19/2006

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.408 / Virus Database: 268.13.9/490 - Release Date:
10/20/2006

Re: [Snort-sigs] Help

From: Joel Esler <joel.esler@so...> - 2006-10-24 04:59

Your subject says "help", however, i didn't see a question.

What did you need help with?

Joel

On Oct 22, 2006, at 10:39 PM, Chad Gross wrote:

>
>
> -----Original Message-----
> From: snort-sigs-bounces@lists.sourceforge.net /> > [mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of
> snort-sigs-request@lists.sourceforge.net /> > Sent: Thursday, October 19, 2006 7:49 AM
> To: snort-sigs@lists.sourceforge.net /> > Subject: Snort-sigs Digest, Vol 5, Issue 8
>
> Send Snort-sigs mailing list submissions to
> snort-sigs@lists.sourceforge.net /> >
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> or, via email, send a message with subject or body 'help' to
> snort-sigs-request@lists.sourceforge.net /> >
> You can reach the person managing the list at
> snort-sigs-owner@lists.sourceforge.net /> >
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-sigs digest..."
>
>
> Today's Topics:
>
> 1. Sourcefire VRT Certified Rules Update (Sourcefire VRT)
> 2. False Positive (Adam Clinch)
> 3. False postive SID 7100 (East, Bill)
> 4. Bleeding Edge Threats Daily Update
> (bleeding@bleedingthreats.net) /> > 5. Bleeding Edge Threats Daily Update
> (bleeding@bleedingthreats.net) /> > 6. Error in oracle rule... (Jay 'Whip' Grizzard)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 18 Oct 2006 18:05:19 -0400
> From: Sourcefire VRT <research@sourcefire.com>
> Subject: [Snort-sigs] Sourcefire VRT Certified Rules Update
> To: Snort Sigs <snort-sigs@lists.sourceforge.net>
> Message-ID: <4536A51F.9020008@sourcefire.com>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Sourcefire VRT Certified Rules Update
>
> Synopsis:
> The Sourcefire VRT has added multiple rules in the spyware-put and
> backdoor categories to provide coverage for emerging spyware and
> trojan
> horse threats. The VRT has also updated numerous rules in the FTP
> category to accommodate larger default values for FTP services,
> additionally reference information has been added and improved
> throughout the VRT Certified Rule Set.
>
>
> Details:
> As a result of ongoing research, the Sourcefire VRT has added multiple
> rules to the spyware and backdoor rule sets to provide coverage for
> emerging threats from these technologies.
>
> A number of rules in the FTP rule category have been updated to
> accommodate larger default values in some FTP services.
>
> The VRT has also updated and added reference information throughout
> the
> entire Sourcefire VRT Certified Rule Set.
>
> For a complete list of new and modified rules:
>
> http://www.snort.org/rules/docs/ruleset_changelogs/
> changes-2006-10-18.ht
> ml
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.4 (Darwin)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFFNqUfMpm0ve0NhMcRAv9SAJ0QLYKWSfVWR2vU0/azL4Bowa/iDQCgooOa
> 3PR6taVgZFnVslLJYSTYEaU=
> =pGnz
> -----END PGP SIGNATURE-----
>
>
>
> ------------------------------
>
> Message: 2
> Date: Fri, 29 Sep 2006 20:03:35 +1000
> From: Adam Clinch <adam.clinch@gmail.com>
> Subject: [Snort-sigs] False Positive
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <451CEF77.2040301@gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> # This is a template for submitting snort signature descriptions to
> # the snort.org website
> #
> # Ensure that your descriptions are your own
> # and not the work of others. References in the rules themselves
> # should be used for linking to other's work.
> #
> # If you are unsure of some part of a rule, use that as a commentary
> # and someone else perhaps will be able to fix it.
> #
> # $Id$
> #
> #
>
> Rule:
> spyware-put.rules:alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> (msg:"SPYWARE-PUT Adware hxdl runtime detection - crypt user-agent";
> flow:to_server,established; content:"User-Agent|3A|"; nocase;
> content:"CryptRetrieveObjectByUrl|3A 3A|InetSchemeProvider";
> distance:0;
> nocase;
> pcre:"/^User-Agent\x3A[^\r\n]+CryptRetrieveObjectByUrl\x3A
> \x3AInetScheme
> Provider/smi";
> reference:url,www.spywareguide.com/product_show.php?id=516;
> reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075079;
> classtype:misc-activity; sid:7555; rev:1;)
>
> --
> Sid:
> 7555
> --
> Summary:
> This event is generated when activity relating to a spyware
> application
> is detected.
> --
> Impact:
> Unkown. Possible information disclosure, violation of privacy,
> possible
> violation of policy.
> --
> Detailed Information:
>
> --
> Affected Systems:
>
> --
> Attack Scenarios:
>
> --
> Ease of Attack:
>
> --
> False Positives:
> Triggers on crl.microsoft.com
>
>
> source addr dest addr Ver Hdr Len TOS length
> ID flags
> offset TTL chksum
> 147.10.195.135
> <http://192.168.0.254/acid/acid_stat_ipaddr.php?
> ip=147.10.195.135&netmas
> k=32>
> 131.107.115.28
> <http://192.168.0.254/acid/acid_stat_ipaddr.php?
> ip=131.107.115.28&netmas
> k=32>
> 4 5 0 461 15547 0 0 64
> 44886
>
> 000 : 47 45 54 20 2F 70 6B 69 2F 63 72 6C 2F 70 72 6F GET /pki/
> crl/pro
> 010 : 64 75 63 74 73 2F 43 6F 64 65 53 69 67 6E 50 43 ducts/
> CodeSignPC
> 020 : 41 2E 63 72 6C 20 48 54 54 50 2F 31 2E 30 0D 0A A.crl HTTP/
> 1.0..
> 030 : 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 55 73 65 Accept: */
> *..Use
> 040 : 72 2D 41 67 65 6E 74 3A 20 43 72 79 70 74 52 65 r-Agent:
> CryptRe
> 050 : 74 72 69 65 76 65 4F 62 6A 65 63 74 42 79 55 72
> trieveObjectByUr
> 060 : 6C 3A 3A 49 6E 65 74 53 63 68 65 6D 65 50 72 6F
> l::InetSchemePro
> 070 : 76 69 64 65 72 0D 0A 48 6F 73 74 3A 20 63 72 6C
> vider..Host: crl
> 080 : 2E 6D 69 63 72 6F 73 6F 66 74 2E 63 6F 6D 0D
> 0A .microsoft.com..
> 090 : 43 6F 6F 6B 69 65 3A 20 73 5F 6E 72 3D 31 31 35 Cookie:
> s_nr=115
> 0a0 : 38 39 38 38 31 37 36 35 35 30 3B 20 57 54 5F 46 8988176550;
> WT_F
> 0b0 : 50 43 3D 69 64 3D 31 34 37 2E 31 30 2E 31 39 35
> PC=id=147.10.195
> 0c0 : 2E 31 33 35 2D 31 31 33 34 36 37 32 31 31 32 2E .
> 135-1134672112.
> 0d0 : 32 39 38 31 30 33 37 38 3A 6C 76 3D 31 31 35 38
> 29810378:lv=1158
> 0e0 : 39 32 33 33 35 37 38 32 30 3A 73 73 3D 31 31 35
> 923357820:ss=115
> 0f0 : 38 39 35 32 31 30 35 39 31 30 3B 20 4D 43 31 3D 8952105910;
> MC1=
> 100 : 47 55 49 44 3D 39 30 62 34 38 64 36 39 61 63 64
> GUID=90b48d69acd
> 110 : 66 32 65 34 64 61 39 34 61 63 38 63 66 32 33 34
> f2e4da94ac8cf234
> 120 : 61 62 33 61 39 26 48 41 53 48 3D 36 39 38 64 26
> ab3a9&HASH=698d&
> 130 : 4C 56 3D 32 30 30 36 39 26 56 3D 33 3B 20 41 3D
> LV=20069&V=3; A=
> 140 : 49 26 49 3D 41 78 55 46 41 41 41 41 41 41 43 57
> I&I=AxUFAAAAAACW
> 150 : 42 77 41 41 7A 53 39 42 54 35 4A 4A 2B 39 6A 34 BwAAzS9BT5JJ
> +9j4
> 160 : 36 46 75 6C 6A 58 30 65 74 67 21 21 0D 0A 43 61
> 6FuljX0etg!!..Ca
> 170 : 63 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D che-
> Control: no-
> 180 : 63 61 63 68 65 2C 20 6D 61 78 2D 61 67 65 3D 32 cache, max-
> age=2
> 190 : 35 39 32 30 30 0D 0A 0D 0A 59200....
>
>
> --
> False Negatives:
>
> --
> Corrective Action:
>
> --
> Contributors:
>
> --
> Additional References:
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://sourceforge.net/mailarchive/forum.php?forum=snort-sigs/
> attachment
> s/20060929/d1c0cb57/attachment.html
>
> ------------------------------
>
> Message: 3
> Date: Wed, 4 Oct 2006 09:51:50 -0400
> From: "East, Bill" <eastb@PFFCU.org>
> Subject: [Snort-sigs] False postive SID 7100
> To: <snort-sigs@lists.sourceforge.net>
> Message-ID:
> <DB70207C75570343BD590F95BA86ADBC010D15E9@ccex0505.pffcu.org>
>
> # This is a template for submitting snort signature descriptions to
> # the snort.org website
> #
> # Ensure that your descriptions are your own
> # and not the work of others. References in the rules themselves
> # should be used for linking to other's work.
> #
> # If you are unsure of some part of a rule, use that as a commentary
> # and someone else perhaps will be able to fix it.
> #
> # $Id$
> #
> #
>
> Rule: BACKDOOR mass connect 1.1 runtime detection - http
>
> --
> Sid: 7100
>
> --
> Summary:
>
> --
> Impact:
>
> --
> Detailed Information:
>
> --
> Affected Systems:
>
> --
> Attack Scenarios:
>
> --
> Ease of Attack:
>
> --
> False Positives: Numara Software, makers of TrackIt! audit software,
> also use the UtilMind useragent to pull down content. This is
> sufficient
> to trigger the rule.
>
> --
> False Negatives:
>
> --
> Corrective Action:
>
> --
> Contributors:
>
> --
> Additional References:
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Tue, 17 Oct 2006 21:00:10 -0400 (EDT)
> From: bleeding@bleedingthreats.net /> > Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20061018010010.65F1A5502A1@gort.offsitefilter.com>
> Content-Type: text/plain
>
>
> [***] Results from Oinkmaster started Tue Oct 17 21:00:10 2006 [***]
>
> [+++] Added rules: [+++]
>
> 2003118 - BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai polymorphic
> payload (bleeding-virus.rules)
> 2003119 - BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic payload
> (bleeding-virus.rules)
> 2003120 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
> (bleeding-policy.rules)
> 2003121 - BLEEDING-EDGE docs.google.com Activity
> (bleeding-policy.rules)
> 2003122 - BLEEDING-EDGE Possible docs.google.com Activity
> (bleeding-policy.rules)
>
>
> [///] Modified active rules: [///]
>
> 2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
> (bleeding-dshield.rules)
> 2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
> (bleeding-dshield-BLOCK.rules)
> 2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
> (bleeding-botcc.rules)
> 2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
> (bleeding-botcc.rules)
> 2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
> (bleeding-botcc.rules)
> 2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
> (bleeding-botcc.rules)
> 2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
> (bleeding-botcc.rules)
> 2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
>
>
> [---] Removed rules: [---]
>
> 2003118 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
> (bleeding-policy.rules)
>
>
> [+++] Added non-rule lines: [+++]
>
> -> Added to bleeding-policy.rules (1):
> # Submitted 2006-10-17 by Adam Nunn
>
> -> Added to bleeding-sid-msg.map (5):
> 2003118 || BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai
> polymorphic payload || url,toorcon.org/2006/conference.html?id=29
> 2003119 || BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic
> payload || url,toorcon.org/2006/conference.html?id=29
> 2003120 || BLEEDING-EDGE POLICY Possible Image Spam Inbound
> (3)
> 2003121 || BLEEDING-EDGE docs.google.com Activity ||
> url,docs.google.com
> 2003122 || BLEEDING-EDGE Possible docs.google.com Activity ||
> url,docs.google.com
>
> [---] Removed non-rule lines: [---]
>
> -> Removed from bleeding-sid-msg.map (1):
> 2003118 || BLEEDING-EDGE POLICY Possible Image Spam Inbound
> (3)
>
> -> Removed from bleeding-virus.rules (2):
> #alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-
> EDGE
> VIRUS SHELLCODE Shikata Ga Nai polymorphic payload";
> classtype:shellcode-detect; dsize: >26; content: "|d9 74 24 f4|";
> pcre:
> "/[\x29\x2b\x31\x33]\xc9/sm"; pcre:
> "/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-
> \x5f]/s
> m"; pcre:
> "/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^
> \x00\
> xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^
> \x00]
> [^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43
> \x46\x
> 47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0
> \xc2\
> xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc]
> [\x03\
> x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73
> \x77\x
> 78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c
> \x0e
> -\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|([\x29\x2b\x31
> \x33
> \xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^
> \x00][^
> \x00][^\x00][^\x00][\x24\
>
> xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf
> \xd9]
> [^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53
> \x55-\x5
> 8\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d
> \x7e\
> xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc]
> [\x03\x3
> 1\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b
> \x6e-\
> x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea
> \xeb
> \xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/
> sm";
> reference:url,toorcon.org/2006/conference.html?id=29; sid;2003118;
> rev:1;)
> #alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-
> EDGE
> VIRUS SHELLCODE ADMutate polymorphic payload";
> classtype:shellcode-detect; dsize: >45; content: "|e8|"; content: "|ff
> ff ff|"; distance: 1; within: 3; pcre:
> "/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83
> \xec
> \x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0
> \x91))|((\
> x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|
> \x6a.
> \x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b
> \x06\x0
> 9\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40
> \x96).{0
> ,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96
> \x40\x
> 96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].
> {0,20}\
> xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";
> reference:url,toorcon.org/2006/conference.html?id=29; sid;2003119;
> rev:1;)
>
>
>
>
> ------------------------------
>
> Message: 5
> Date: Wed, 18 Oct 2006 21:00:09 -0400 (EDT)
> From: bleeding@bleedingthreats.net /> > Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20061019010009.474F155026A@gort.offsitefilter.com>
> Content-Type: text/plain
>
>
> [***] Results from Oinkmaster started Wed Oct 18 21:00:07 2006 [***]
>
> [///] Modified active rules: [///]
>
> 2001850 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
> Requested (1) (bleeding-malware.rules)
> 2002093 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
> Requested (2) (bleeding-malware.rules)
> 2002697 - BLEEDING-EDGE EXPLOIT CVSTrac filediff Arbitrary Remote
> Code
> Execution (bleeding-exploit.rules)
> 2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
> (bleeding-dshield.rules)
> 2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
> (bleeding-dshield-BLOCK.rules)
> 2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
> (bleeding-botcc.rules)
> 2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
> (bleeding-botcc.rules)
> 2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
> (bleeding-botcc.rules)
> 2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
> (bleeding-botcc.rules)
> 2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
> (bleeding-botcc.rules)
> 2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
>
>
> [///] Modified inactive rules: [///]
>
> 2002692 - BLEEDING-EDGE CURRENT EVENTS Bagle.Gen HTTP Get Traffic -
> Possible Infected Host (bleeding.rules)
>
>
> [*] Non-rule line modifications: [*]
> None.
>
>
>
>
> ------------------------------
>
> Message: 6
> Date: Fri, 22 Sep 2006 15:57:43 -0700
> From: Jay 'Whip' Grizzard <elfchief@lupine.org>
> Subject: [Snort-sigs] Error in oracle rule...
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20060922225743.GK7734@zash.lupine.org>
> Content-Type: text/plain; charset=us-ascii
>
> I'm not certain where the right place to send bug reports in rules to
> is,
> and haven't been able to find specific data, so I'll try here.
>
> I think that the oracle 'user name buffer overflow attempt' rule (sid
> 2650)
> is wrong and does not check for the correct string.
>
> It currently reads (relevant snippet):
>
> content:"|28|user="; nocase; isdataat:1000,relative; content:!"|22|";
> within:1000
>
> 0x28 = (
> 0x22 = "
>
> ... which is basically saying to match on the string "(user=" if
> there's
> not
> a quote within the next thousand characters.
>
> What I think it's *supposed* to do is to match if there's not a
> closing
> parenthesis within the next thousand characters, since the string used
> in actual requests is "(user=<username>)".
>
> So I think the rule should actually be (again, relevant snippet):
>
> content:"|28|user="; nocase; isdataat:1000,relative; content:!"|29|";
> within:1000
>
> Thanks for your attention.
>
> -jay
>
>
>
> ------------------------------
>
> ----------------------------------------------------------------------
> --
> -
> Using Tomcat but need to do more? Need to support web services,
> security?
> Get stuff done quickly with -integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?
> cmd=lnk&kid=120709&bid=263057&dat=121642
>
> ------------------------------
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
>
> End of Snort-sigs Digest, Vol 5, Issue 8
> ****************************************
>
> --
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.408 / Virus Database: 268.13.5/485 - Release Date:
> 10/19/2006
>
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.1.408 / Virus Database: 268.13.9/490 - Release Date:
> 10/20/2006
>
>
>
> ----------------------------------------------------------------------
> ---
> Using Tomcat but need to do more? Need to support web services,
> security?
> Get stuff done quickly with -integrated technology to make your
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>

+---------------------------------------------------------------------+
joel esler senior security consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
gpg key: http://demo.sourcefire.com/jesler.pgp.key
aim:eslerjoel ymsg:eslerjoel gtalk:eslerj
+---------------------------------------------------------------------+

Re: [Snort-sigs] Help

From: Chad Gross <cgross@lo...> - 2006-10-31 02:59

My bad, sorry for the spam.

-----Original Message-----
From: Joel Esler [mailto:joel.esler@sourcefire.com]
Sent: Monday, October 23, 2006 6:09 PM
To: Chad Gross
Cc: snort-sigs@lists.sourceforge.net /> Subject: Re: [Snort-sigs] Help

Your subject says "help", however, i didn't see a question.

What did you need help with?

Joel

On Oct 22, 2006, at 10:39 PM, Chad Gross wrote:

>
>
> -----Original Message-----
> From: snort-sigs-bounces@lists.sourceforge.net /> > [mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of
> snort-sigs-request@lists.sourceforge.net /> > Sent: Thursday, October 19, 2006 7:49 AM
> To: snort-sigs@lists.sourceforge.net /> > Subject: Snort-sigs Digest, Vol 5, Issue 8
>
> Send Snort-sigs mailing list submissions to
> snort-sigs@lists.sourceforge.net /> >
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> or, via email, send a message with subject or body 'help' to
> snort-sigs-request@lists.sourceforge.net /> >
> You can reach the person managing the list at
> snort-sigs-owner@lists.sourceforge.net /> >
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-sigs digest..."
>
>
> Today's Topics:
>
> 1. Sourcefire VRT Certified Rules Update (Sourcefire VRT)
> 2. False Positive (Adam Clinch)
> 3. False postive SID 7100 (East, Bill)
> 4. Bleeding Edge Threats Daily Update
> (bleeding@bleedingthreats.net) /> > 5. Bleeding Edge Threats Daily Update
> (bleeding@bleedingthreats.net) /> > 6. Error in oracle rule... (Jay 'Whip' Grizzard)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 18 Oct 2006 18:05:19 -0400
> From: Sourcefire VRT <research@sourcefire.com>
> Subject: [Snort-sigs] Sourcefire VRT Certified Rules Update
> To: Snort Sigs <snort-sigs@lists.sourceforge.net>
> Message-ID: <4536A51F.9020008@sourcefire.com>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Sourcefire VRT Certified Rules Update
>
> Synopsis:
> The Sourcefire VRT has added multiple rules in the spyware-put and
> backdoor categories to provide coverage for emerging spyware and
> trojan
> horse threats. The VRT has also updated numerous rules in the FTP
> category to accommodate larger default values for FTP services,
> additionally reference information has been added and improved
> throughout the VRT Certified Rule Set.
>
>
> Details:
> As a result of ongoing research, the Sourcefire VRT has added multiple
> rules to the spyware and backdoor rule sets to provide coverage for
> emerging threats from these technologies.
>
> A number of rules in the FTP rule category have been updated to
> accommodate larger default values in some FTP services.
>
> The VRT has also updated and added reference information throughout
> the
> entire Sourcefire VRT Certified Rule Set.
>
> For a complete list of new and modified rules:
>
> http://www.snort.org/rules/docs/ruleset_changelogs/
> changes-2006-10-18.ht
> ml
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.4 (Darwin)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFFNqUfMpm0ve0NhMcRAv9SAJ0QLYKWSfVWR2vU0/azL4Bowa/iDQCgooOa
> 3PR6taVgZFnVslLJYSTYEaU=
> =pGnz
> -----END PGP SIGNATURE-----
>
>
>
> ------------------------------
>
> Message: 2
> Date: Fri, 29 Sep 2006 20:03:35 +1000
> From: Adam Clinch <adam.clinch@gmail.com>
> Subject: [Snort-sigs] False Positive
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <451CEF77.2040301@gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> # This is a template for submitting snort signature descriptions to
> # the snort.org website
> #
> # Ensure that your descriptions are your own
> # and not the work of others. References in the rules themselves
> # should be used for linking to other's work.
> #
> # If you are unsure of some part of a rule, use that as a commentary
> # and someone else perhaps will be able to fix it.
> #
> # $Id$
> #
> #
>
> Rule:
> spyware-put.rules:alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
> (msg:"SPYWARE-PUT Adware hxdl runtime detection - crypt user-agent";
> flow:to_server,established; content:"User-Agent|3A|"; nocase;
> content:"CryptRetrieveObjectByUrl|3A 3A|InetSchemeProvider";
> distance:0;
> nocase;
> pcre:"/^User-Agent\x3A[^\r\n]+CryptRetrieveObjectByUrl\x3A
> \x3AInetScheme
> Provider/smi";
> reference:url,www.spywareguide.com/product_show.php?id=516;
> reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075079;
> classtype:misc-activity; sid:7555; rev:1;)
>
> --
> Sid:
> 7555
> --
> Summary:
> This event is generated when activity relating to a spyware
> application
> is detected.
> --
> Impact:
> Unkown. Possible information disclosure, violation of privacy,
> possible
> violation of policy.
> --
> Detailed Information:
>
> --
> Affected Systems:
>
> --
> Attack Scenarios:
>
> --
> Ease of Attack:
>
> --
> False Positives:
> Triggers on crl.microsoft.com
>
>
> source addr dest addr Ver Hdr Len TOS length
> ID flags
> offset TTL chksum
> 147.10.195.135
> <http://192.168.0.254/acid/acid_stat_ipaddr.php?
> ip=147.10.195.135&netmas
> k=32>
> 131.107.115.28
> <http://192.168.0.254/acid/acid_stat_ipaddr.php?
> ip=131.107.115.28&netmas
> k=32>
> 4 5 0 461 15547 0 0 64
> 44886
>
> 000 : 47 45 54 20 2F 70 6B 69 2F 63 72 6C 2F 70 72 6F GET /pki/
> crl/pro
> 010 : 64 75 63 74 73 2F 43 6F 64 65 53 69 67 6E 50 43 ducts/
> CodeSignPC
> 020 : 41 2E 63 72 6C 20 48 54 54 50 2F 31 2E 30 0D 0A A.crl HTTP/
> 1.0..
> 030 : 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 55 73 65 Accept: */
> *..Use
> 040 : 72 2D 41 67 65 6E 74 3A 20 43 72 79 70 74 52 65 r-Agent:
> CryptRe
> 050 : 74 72 69 65 76 65 4F 62 6A 65 63 74 42 79 55 72
> trieveObjectByUr
> 060 : 6C 3A 3A 49 6E 65 74 53 63 68 65 6D 65 50 72 6F
> l::InetSchemePro
> 070 : 76 69 64 65 72 0D 0A 48 6F 73 74 3A 20 63 72 6C
> vider..Host: crl
> 080 : 2E 6D 69 63 72 6F 73 6F 66 74 2E 63 6F 6D 0D
> 0A .microsoft.com..
> 090 : 43 6F 6F 6B 69 65 3A 20 73 5F 6E 72 3D 31 31 35 Cookie:
> s_nr=115
> 0a0 : 38 39 38 38 31 37 36 35 35 30 3B 20 57 54 5F 46 8988176550;
> WT_F
> 0b0 : 50 43 3D 69 64 3D 31 34 37 2E 31 30 2E 31 39 35
> PC=id=147.10.195
> 0c0 : 2E 31 33 35 2D 31 31 33 34 36 37 32 31 31 32 2E .
> 135-1134672112.
> 0d0 : 32 39 38 31 30 33 37 38 3A 6C 76 3D 31 31 35 38
> 29810378:lv=1158
> 0e0 : 39 32 33 33 35 37 38 32 30 3A 73 73 3D 31 31 35
> 923357820:ss=115
> 0f0 : 38 39 35 32 31 30 35 39 31 30 3B 20 4D 43 31 3D 8952105910;
> MC1=
> 100 : 47 55 49 44 3D 39 30 62 34 38 64 36 39 61 63 64
> GUID=90b48d69acd
> 110 : 66 32 65 34 64 61 39 34 61 63 38 63 66 32 33 34
> f2e4da94ac8cf234
> 120 : 61 62 33 61 39 26 48 41 53 48 3D 36 39 38 64 26
> ab3a9&HASH=698d&
> 130 : 4C 56 3D 32 30 30 36 39 26 56 3D 33 3B 20 41 3D
> LV=20069&V=3; A=
> 140 : 49 26 49 3D 41 78 55 46 41 41 41 41 41 41 43 57
> I&I=AxUFAAAAAACW
> 150 : 42 77 41 41 7A 53 39 42 54 35 4A 4A 2B 39 6A 34 BwAAzS9BT5JJ
> +9j4
> 160 : 36 46 75 6C 6A 58 30 65 74 67 21 21 0D 0A 43 61
> 6FuljX0etg!!..Ca
> 170 : 63 68 65 2D 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D che-
> Control: no-
> 180 : 63 61 63 68 65 2C 20 6D 61 78 2D 61 67 65 3D 32 cache, max-
> age=2
> 190 : 35 39 32 30 30 0D 0A 0D 0A 59200....
>
>
> --
> False Negatives:
>
> --
> Corrective Action:
>
> --
> Contributors:
>
> --
> Additional References:
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://sourceforge.net/mailarchive/forum.php?forum=snort-sigs/
> attachment
> s/20060929/d1c0cb57/attachment.html
>
> ------------------------------
>
> Message: 3
> Date: Wed, 4 Oct 2006 09:51:50 -0400
> From: "East, Bill" <eastb@PFFCU.org>
> Subject: [Snort-sigs] False postive SID 7100
> To: <snort-sigs@lists.sourceforge.net>
> Message-ID:
> <DB70207C75570343BD590F95BA86ADBC010D15E9@ccex0505.pffcu.org>
>
> # This is a template for submitting snort signature descriptions to
> # the snort.org website
> #
> # Ensure that your descriptions are your own
> # and not the work of others. References in the rules themselves
> # should be used for linking to other's work.
> #
> # If you are unsure of some part of a rule, use that as a commentary
> # and someone else perhaps will be able to fix it.
> #
> # $Id$
> #
> #
>
> Rule: BACKDOOR mass connect 1.1 runtime detection - http
>
> --
> Sid: 7100
>
> --
> Summary:
>
> --
> Impact:
>
> --
> Detailed Information:
>
> --
> Affected Systems:
>
> --
> Attack Scenarios:
>
> --
> Ease of Attack:
>
> --
> False Positives: Numara Software, makers of TrackIt! audit software,
> also use the UtilMind useragent to pull down content. This is
> sufficient
> to trigger the rule.
>
> --
> False Negatives:
>
> --
> Corrective Action:
>
> --
> Contributors:
>
> --
> Additional References:
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Tue, 17 Oct 2006 21:00:10 -0400 (EDT)
> From: bleeding@bleedingthreats.net /> > Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20061018010010.65F1A5502A1@gort.offsitefilter.com>
> Content-Type: text/plain
>
>
> [***] Results from Oinkmaster started Tue Oct 17 21:00:10 2006 [***]
>
> [+++] Added rules: [+++]
>
> 2003118 - BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai polymorphic
> payload (bleeding-virus.rules)
> 2003119 - BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic payload
> (bleeding-virus.rules)
> 2003120 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
> (bleeding-policy.rules)
> 2003121 - BLEEDING-EDGE docs.google.com Activity
> (bleeding-policy.rules)
> 2003122 - BLEEDING-EDGE Possible docs.google.com Activity
> (bleeding-policy.rules)
>
>
> [///] Modified active rules: [///]
>
> 2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
> (bleeding-dshield.rules)
> 2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
> (bleeding-dshield-BLOCK.rules)
> 2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
> (bleeding-botcc.rules)
> 2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
> (bleeding-botcc.rules)
> 2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
> (bleeding-botcc.rules)
> 2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
> (bleeding-botcc.rules)
> 2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
> (bleeding-botcc.rules)
> 2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
>
>
> [---] Removed rules: [---]
>
> 2003118 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
> (bleeding-policy.rules)
>
>
> [+++] Added non-rule lines: [+++]
>
> -> Added to bleeding-policy.rules (1):
> # Submitted 2006-10-17 by Adam Nunn
>
> -> Added to bleeding-sid-msg.map (5):
> 2003118 || BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai
> polymorphic payload || url,toorcon.org/2006/conference.html?id=29
> 2003119 || BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic
> payload || url,toorcon.org/2006/conference.html?id=29
> 2003120 || BLEEDING-EDGE POLICY Possible Image Spam Inbound
> (3)
> 2003121 || BLEEDING-EDGE docs.google.com Activity ||
> url,docs.google.com
> 2003122 || BLEEDING-EDGE Possible docs.google.com Activity ||
> url,docs.google.com
>
> [---] Removed non-rule lines: [---]
>
> -> Removed from bleeding-sid-msg.map (1):
> 2003118 || BLEEDING-EDGE POLICY Possible Image Spam Inbound
> (3)
>
> -> Removed from bleeding-virus.rules (2):
> #alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-
> EDGE
> VIRUS SHELLCODE Shikata Ga Nai polymorphic payload";
> classtype:shellcode-detect; dsize: >26; content: "|d9 74 24 f4|";
> pcre:
> "/[\x29\x2b\x31\x33]\xc9/sm"; pcre:
> "/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-
> \x5f]/s
> m"; pcre:
> "/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^
> \x00\
> xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^
> \x00]
> [^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43
> \x46\x
> 47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0
> \xc2\
> xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc]
> [\x03\
> x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73
> \x77\x
> 78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c
> \x0e
> -\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|([\x29\x2b\x31
> \x33
> \xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^
> \x00][^
> \x00][^\x00][^\x00][\x24\
>
> xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf
> \xd9]
> [^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53
> \x55-\x5
> 8\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d
> \x7e\
> xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc]
> [\x03\x3
> 1\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b
> \x6e-\
> x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea
> \xeb
> \xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/
> sm";
> reference:url,toorcon.org/2006/conference.html?id=29; sid;2003118;
> rev:1;)
> #alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-
> EDGE
> VIRUS SHELLCODE ADMutate polymorphic payload";
> classtype:shellcode-detect; dsize: >45; content: "|e8|"; content: "|ff
> ff ff|"; distance: 1; within: 3; pcre:
> "/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83
> \xec
> \x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0
> \x91))|((\
> x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|
> \x6a.
> \x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b
> \x06\x0
> 9\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40
> \x96).{0
> ,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96
> \x40\x
> 96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].
> {0,20}\
> xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";
> reference:url,toorcon.org/2006/conference.html?id=29; sid;2003119;
> rev:1;)
>
>
>
>
> ------------------------------
>
> Message: 5
> Date: Wed, 18 Oct 2006 21:00:09 -0400 (EDT)
> From: bleeding@bleedingthreats.net /> > Subject: [Snort-sigs] Bleeding Edge Threats Daily Update
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20061019010009.474F155026A@gort.offsitefilter.com>
> Content-Type: text/plain
>
>
> [***] Results from Oinkmaster started Wed Oct 18 21:00:07 2006 [***]
>
> [///] Modified active rules: [///]
>
> 2001850 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
> Requested (1) (bleeding-malware.rules)
> 2002093 - BLEEDING-EDGE MALWARE Likely Trojan/Spyware Installer
> Requested (2) (bleeding-malware.rules)
> 2002697 - BLEEDING-EDGE EXPLOIT CVSTrac filediff Arbitrary Remote
> Code
> Execution (bleeding-exploit.rules)
> 2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
> (bleeding-dshield.rules)
> 2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
> (bleeding-dshield-BLOCK.rules)
> 2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
> (bleeding-botcc.rules)
> 2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
> (bleeding-botcc.rules)
> 2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
> (bleeding-botcc.rules)
> 2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
> (bleeding-botcc.rules)
> 2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
> (bleeding-botcc.rules)
> 2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
> 2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) -
> BLOCKING
> SOURCE (bleeding-botcc-BLOCK.rules)
>
>
> [///] Modified inactive rules: [///]
>
> 2002692 - BLEEDING-EDGE CURRENT EVENTS Bagle.Gen HTTP Get Traffic -
> Possible Infected Host (bleeding.rules)
>
>
> [*] Non-rule line modifications: [*]
> None.
>
>
>
>
> ------------------------------
>
> Message: 6
> Date: Fri, 22 Sep 2006 15:57:43 -0700
> From: Jay 'Whip' Grizzard <elfchief@lupine.org>
> Subject: [Snort-sigs] Error in oracle rule...
> To: snort-sigs@lists.sourceforge.net /> > Message-ID: <20060922225743.GK7734@zash.lupine.org>
> Content-Type: text/plain; charset=us-ascii
>
> I'm not certain where the right place to send bug reports in rules to
> is,
> and haven't been able to find specific data, so I'll try here.
>
> I think that the oracle 'user name buffer overflow attempt' rule (sid
> 2650)
> is wrong and does not check for the correct string.
>
> It currently reads (relevant snippet):
>
> content:"|28|user="; nocase; isdataat:1000,relative; content:!"|22|";
> within:1000
>
> 0x28 = (
> 0x22 = "
>
> ... which is basically saying to match on the string "(user=" if
> there's
> not
> a quote within the next thousand characters.
>
> What I think it's *supposed* to do is to match if there's not a
> closing
> parenthesis within the next thousand characters, since the string used
> in actual requests is "(user=<username>)".
>
> So I think the rule should actually be (again, relevant snippet):
>
> content:"|28|user="; nocase; isdataat:1000,relative; content:!"|29|";
> within:1000
>
> Thanks for your attention.
>
> -jay
>
>
>
> ------------------------------
>
> ----------------------------------------------------------------------

> --
> -
> Using Tomcat but need to do more? Need to support web services,
> security?
> Get stuff done quickly with -integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?
> cmd=lnk&kid=120709&bid=263057&dat=121642
>
> ------------------------------
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
>
> End of Snort-sigs Digest, Vol 5, Issue 8
> ****************************************
>
> --
> No virus found in this incoming message.
> Checked by AVG Free Edition.
> Version: 7.1.408 / Virus Database: 268.13.5/485 - Release Date:
> 10/19/2006
>
>
>
> --
> No virus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.1.408 / Virus Database: 268.13.9/490 - Release Date:
> 10/20/2006
>
>
>
> ----------------------------------------------------------------------

> ---
> Using Tomcat but need to do more? Need to support web services,
> security?
> Get stuff done quickly with -integrated technology to make your
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>

+---------------------------------------------------------------------+
joel esler senior security consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
gpg key: http://demo.sourcefire.com/jesler.pgp.key
aim:eslerjoel ymsg:eslerjoel gtalk:eslerj
+---------------------------------------------------------------------+

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.408 / Virus Database: 268.13.11/493 - Release Date:
10/23/2006

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.408 / Virus Database: 268.13.17/505 - Release Date:
10/27/2006

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-21 01:00

[***] Results from Oinkmaster started Fri Oct 20 21:00:07 2006 [***]

[+++] Added rules: [+++]

2003126 - BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25 (bleeding-policy.rules)
2003128 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (ehlo) (bleeding-policy.rules)
2003129 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (starttls) (bleeding-policy.rules)
2003130 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (helo) (bleeding-policy.rules)
2003131 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (authsmtp) (bleeding-policy.rules)
2003132 - BLEEDING-EDGE TROJAN BOT - potential DDoS command (2) (bleeding-virus.rules)

[///] Modified active rules: [///]

2001852 - BLEEDING-EDGE MALWARE 404Search Spyware User Agent (bleeding-malware.rules)
2001853 - BLEEDING-EDGE MALWARE Easy Search Bar Spyware User Agent (bleeding-malware.rules)
2001854 - BLEEDING-EDGE MALWARE EZULA Spyware User Agent (bleeding-malware.rules)
2001855 - BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (1) (bleeding-malware.rules)
2001858 - BLEEDING-EDGE MALWARE Hotbar Spyware User Agent (bleeding-malware.rules)
2001859 - BLEEDING-EDGE MALWARE Cool Web Search Spyware User Agent (bleeding-malware.rules)
2001860 - BLEEDING-EDGE MALWARE Kontiki Spyware User Agent (bleeding-malware.rules)
2001861 - BLEEDING-EDGE MALWARE Micro-Gaming Spyware User Agent (bleeding-malware.rules)
2001862 - BLEEDING-EDGE MALWARE Surf Assistant Spyware User Agent (bleeding-malware.rules)
2001863 - BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (2) (bleeding-malware.rules)
2001864 - BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (3) (bleeding-malware.rules)
2001865 - BLEEDING-EDGE MALWARE MyWebSearch Spyware User Agent (bleeding-malware.rules)
2001867 - BLEEDING-EDGE MALWARE Search Engine 2000 Spyware User Agent (bleeding-malware.rules)
2001868 - BLEEDING-EDGE MALWARE SureSeeker Spyware User Agent (bleeding-malware.rules)
2001869 - BLEEDING-EDGE MALWARE Sidesearch Spyware User Agent (bleeding-malware.rules)
2001870 - BLEEDING-EDGE MALWARE Surfplayer Spyware User Agent (bleeding-malware.rules)
2001871 - BLEEDING-EDGE MALWARE Target Saver Spyware User Agent (bleeding-malware.rules)
2001872 - BLEEDING-EDGE MALWARE Visicom Spyware User Agent (bleeding-malware.rules)
2002032 - BLEEDING-EDGE TROJAN BOT - potential DDoS command (1) (bleeding-virus.rules)
2002382 - BLEEDING-EDGE EXPLOIT Wzdftpd SITE command arbitrary command execution attempt (bleeding-exploit.rules)
2003123 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (mail from) (bleeding-policy.rules)
2003124 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (rcpt to) (bleeding-policy.rules)
2003125 - BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (01) (bleeding-policy.rules)
2003127 - BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (00) (bleeding-policy.rules)
2400000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound (bleeding-drop.rules)
2400001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound (bleeding-drop.rules)
2400002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound (bleeding-drop.rules)
2400003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound (bleeding-drop.rules)
2400004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound (bleeding-drop.rules)
2401000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (bleeding-drop-BLOCK.rules)
2401001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (bleeding-drop-BLOCK.rules)
2401002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (bleeding-drop-BLOCK.rules)
2401003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (bleeding-drop-BLOCK.rules)
2401004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (bleeding-drop-BLOCK.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[---] Removed rules: [---]

2001866 - BLEEDING-EDGE MALWARE Smartpops/Mediaload Spyware User Agent (bleeding-malware.rules)
2002077 - BLEEDING-EDGE Malware IEBar Spyware User Agent Activity (bleeding-malware.rules)
2002162 - BLEEDING-EDGE MALWARE CoolWebSearch Spyware (SCAgent) (bleeding-malware.rules)
2002669 - BLEEDING-EDGE TROJAN Potential New Spambot Proxy Control Channel - Please report hits to bleeding-sigs@bleedingsnort.com (bleeding-virus.rules)
2003136 - BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25 (bleeding-policy.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-drop-BLOCK.rules (3):
# Rules to block Spamhaus DROP listed networks (www.spamhaus.org)
# Please submit any feedback or ideas to bleeding@bleedingsnort.com or the bleeding-sigs mailing list
# VERSION 2054

-> Added to bleeding-drop.rules (3):
# Rules to block Spamhaus DROP listed networks (www.spamhaus.org)
# Please submit any feedback or ideas to bleeding@bleedingsnort.com or the bleeding-sigs mailing list
# VERSION 2054

-> Added to bleeding-sid-msg.map (25):
2001852 || BLEEDING-EDGE MALWARE 404Search Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001853 || BLEEDING-EDGE MALWARE Easy Search Bar Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001854 || BLEEDING-EDGE MALWARE EZULA Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001855 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (1) || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001858 || BLEEDING-EDGE MALWARE Hotbar Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001859 || BLEEDING-EDGE MALWARE Cool Web Search Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001860 || BLEEDING-EDGE MALWARE Kontiki Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001861 || BLEEDING-EDGE MALWARE Micro-Gaming Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001862 || BLEEDING-EDGE MALWARE Surf Assistant Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001863 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (2) || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001864 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (3) || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents3
2001865 || BLEEDING-EDGE MALWARE MyWebSearch Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001867 || BLEEDING-EDGE MALWARE Search Engine 2000 Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001868 || BLEEDING-EDGE MALWARE SureSeeker Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001869 || BLEEDING-EDGE MALWARE Sidesearch Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001870 || BLEEDING-EDGE MALWARE Surfplayer Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001871 || BLEEDING-EDGE MALWARE Target Saver Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2001872 || BLEEDING-EDGE MALWARE Visicom Spyware User Agent || url,www.bleedingedgethreats.net/cgi-bin/viewcvs.cgi/?root=Spyware-User-Agents
2002032 || BLEEDING-EDGE TROJAN BOT - potential DDoS command (1)
2003126 || BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25
2003128 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (ehlo)
2003129 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (starttls)
2003130 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (helo)
2003131 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (authsmtp)
2003132 || BLEEDING-EDGE TROJAN BOT - potential DDoS command (2)

[---] Removed non-rule lines: [---]

-> Removed from bleeding-drop-BLOCK.rules (6):
# $Id: bleeding-drop.rules $
# Bleeding Snort drop rules.
#These are generated from the Spamhaus DROP list available at
# http://www.spamhaus.org/DROP/
# SID's are 2400000+ to avoid conflicts
# Please submit any custom rules or ideas to bleeding@bleedingsnort.com or the snort-sigs mailing list

-> Removed from bleeding-drop.rules (6):
# $Id: bleeding-drop.rules $
# Bleeding Snort drop rules.
#These are generated from the Spamhaus DROP list available at
# http://www.spamhaus.org/DROP/
# SID's are 2400000+ to avoid conflicts
# Please submit any custom rules or ideas to bleeding@bleedingsnort.com or the snort-sigs mailing list

-> Removed from bleeding-malware.rules (3):
#This is used by a number of things, not unique to spartpops
#disabling, it hits on normal traffic from Windows Media Player, and others. Needs more research
#Disabling, Hits on regular windows update type traffic to sa.windows.com

-> Removed from bleeding-sid-msg.map (24):
2001852 || BLEEDING-EDGE MALWARE 404Search Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001853 || BLEEDING-EDGE MALWARE Easy Search Bar Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001854 || BLEEDING-EDGE MALWARE EZULA Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001855 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (1) || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001858 || BLEEDING-EDGE MALWARE Hotbar Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001859 || BLEEDING-EDGE MALWARE Cool Web Search Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001860 || BLEEDING-EDGE MALWARE Kontiki Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001861 || BLEEDING-EDGE MALWARE Micro-Gaming Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001862 || BLEEDING-EDGE MALWARE Surf Assistant Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001863 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (2) || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001864 || BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (3) || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001865 || BLEEDING-EDGE MALWARE MyWebSearch Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001866 || BLEEDING-EDGE MALWARE Smartpops/Mediaload Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001867 || BLEEDING-EDGE MALWARE Search Engine 2000 Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001868 || BLEEDING-EDGE MALWARE SureSeeker Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001869 || BLEEDING-EDGE MALWARE Sidesearch Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001870 || BLEEDING-EDGE MALWARE Surfplayer Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001871 || BLEEDING-EDGE MALWARE Target Saver Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2001872 || BLEEDING-EDGE MALWARE Visicom Spyware User Agent || url,www.bleedingsnort.com/article.php?story=20050303190103553
2002032 || BLEEDING-EDGE TROJAN BOT - potential DDoS command
2002077 || BLEEDING-EDGE Malware IEBar Spyware User Agent Activity || url,castlecops.com/tk1463-IEBAR_DLL.html
2002162 || BLEEDING-EDGE MALWARE CoolWebSearch Spyware (SCAgent) || url,www.doxdesk.com/parasite/CoolWebSearch.html || url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453075759 || url,www.spywareguide.com/product_show.php?id=599
2002669 || BLEEDING-EDGE TROJAN Potential New Spambot Proxy Control Channel - Please report hits to bleeding-sigs@bleedingsnort.com /> 2003136 || BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25

-> Removed from bleeding-virus.rules (1):
#by Jeff Kell

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-24 01:00

[***] Results from Oinkmaster started Mon Oct 23 21:00:08 2006 [***]

[+++] Added rules: [+++]

2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) (bleeding-botcc.rules)
2410006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) (bleeding-botcc.rules)
2410007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) (bleeding-botcc.rules)
2410008 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) (bleeding-botcc.rules)
2410009 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) (bleeding-botcc.rules)
2410010 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) (bleeding-botcc.rules)
2410011 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) (bleeding-botcc.rules)
2410012 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) (bleeding-botcc.rules)
2410013 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) (bleeding-botcc.rules)
2410014 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) (bleeding-botcc.rules)
2410015 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) (bleeding-botcc.rules)
2410016 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) (bleeding-botcc.rules)
2410017 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) (bleeding-botcc.rules)
2410018 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) (bleeding-botcc.rules)
2410019 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) (bleeding-botcc.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411008 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411009 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411010 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411011 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411012 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411013 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411014 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411015 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411016 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411017 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411018 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411019 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[///] Modified active rules: [///]

2002171 - BLEEDING-EDGE EXPLOIT COM Object Instantiation Memory Corruption Vulnerability (group 1) (bleeding-exploit.rules)
2002172 - BLEEDING-EDGE EXPLOIT COM Object Instantiation Memory Corruption Vulnerability (group 2) (bleeding-exploit.rules)
2002173 - BLEEDING-EDGE EXPLOIT COM Object Instantiation Memory Corruption Vulnerability (group 3) (bleeding-exploit.rules)
2002174 - BLEEDING-EDGE EXPLOIT CLSID Pattern Matched (bleeding-exploit.rules)
2002491 - BLEEDING-EDGE EXPLOIT COM Object MS05-052 (group 1) (bleeding-exploit.rules)
2002492 - BLEEDING-EDGE EXPLOIT COM Object MS05-052 (group 2) (bleeding-exploit.rules)
2002493 - BLEEDING-EDGE EXPLOIT COM Object MS05-052 (group 3) (bleeding-exploit.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-sid-msg.map (30):
2410005 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) || url,www.shadowserver.org
2410006 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) || url,www.shadowserver.org
2410007 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) || url,www.shadowserver.org
2410008 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) || url,www.shadowserver.org
2410009 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) || url,www.shadowserver.org
2410010 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) || url,www.shadowserver.org
2410011 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) || url,www.shadowserver.org
2410012 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) || url,www.shadowserver.org
2410013 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) || url,www.shadowserver.org
2410014 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) || url,www.shadowserver.org
2410015 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) || url,www.shadowserver.org
2410016 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) || url,www.shadowserver.org
2410017 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) || url,www.shadowserver.org
2410018 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) || url,www.shadowserver.org
2410019 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) || url,www.shadowserver.org
2411005 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE || url,www.shadowserver.org
2411006 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE || url,www.shadowserver.org
2411007 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE || url,www.shadowserver.org
2411008 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE || url,www.shadowserver.org
2411009 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE || url,www.shadowserver.org
2411010 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE || url,www.shadowserver.org
2411011 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE || url,www.shadowserver.org
2411012 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE || url,www.shadowserver.org
2411013 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE || url,www.shadowserver.org
2411014 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE || url,www.shadowserver.org
2411015 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE || url,www.shadowserver.org
2411016 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE || url,www.shadowserver.org
2411017 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE || url,www.shadowserver.org
2411018 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE || url,www.shadowserver.org
2411019 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE || url,www.shadowserver.org

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-26 01:00

[***] Results from Oinkmaster started Wed Oct 25 21:00:07 2006 [***]

[+++] Added rules: [+++]

2003145 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (bleeding-exploit.rules)
2003146 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /dhost (bleeding-exploit.rules)
2003147 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /dhost (linewrap) (bleeding-exploit.rules)
2410020 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 21) (bleeding-botcc.rules)
2411020 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
3003147 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap) (bleeding-exploit.rules)

[///] Modified active rules: [///]

2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) (bleeding-botcc.rules)
2410006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) (bleeding-botcc.rules)
2410007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) (bleeding-botcc.rules)
2410008 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) (bleeding-botcc.rules)
2410009 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) (bleeding-botcc.rules)
2410010 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) (bleeding-botcc.rules)
2410011 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) (bleeding-botcc.rules)
2410012 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) (bleeding-botcc.rules)
2410013 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) (bleeding-botcc.rules)
2410014 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) (bleeding-botcc.rules)
2410015 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) (bleeding-botcc.rules)
2410016 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) (bleeding-botcc.rules)
2410017 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) (bleeding-botcc.rules)
2410018 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) (bleeding-botcc.rules)
2410019 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411008 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411009 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411010 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411011 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411012 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411013 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411014 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411015 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411016 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411017 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411018 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411019 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-exploit.rules (1):
#By Michael Hale Ligh and Ryan Smith

-> Added to bleeding-sid-msg.map (6):
2003145 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds
2003146 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /dhost
2003147 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /dhost (linewrap)
2410020 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 21) || url,www.shadowserver.org
2411020 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
3003147 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap)

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-27 01:00

[***] Results from Oinkmaster started Thu Oct 26 21:00:07 2006 [***]

[+++] Added rules: [+++]

2003148 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap) (bleeding-exploit.rules)
2003149 - BLEEDING-EDGE ATTACK RESPONSE Possible /etc/passwd via SMTP (linux style) (bleeding-attack_response.rules)
2003150 - BLEEDING-EDGE ATTACK RESPONSE Possible /etc/passwd via SMTP (BSD style) (bleeding-attack_response.rules)
2003151 - BLEEDING-EDGE Malware Fun Web Products SmileyCentral IEsp2 Install (bleeding-malware.rules)
2003152 - BLEEDING-EDGE WEB CutePHP CuteNews directory traversal vulnerability - show_archives (bleeding-web.rules)
2410021 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 22) (bleeding-botcc.rules)
2411021 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 22) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[///] Modified active rules: [///]

2002668 - BLEEDING-EDGE WEB CutePHP CuteNews directory traversal vulnerability - show_news (bleeding-web.rules)
2003126 - BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25 (bleeding-policy.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) (bleeding-botcc.rules)
2410006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) (bleeding-botcc.rules)
2410007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) (bleeding-botcc.rules)
2410008 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) (bleeding-botcc.rules)
2410009 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) (bleeding-botcc.rules)
2410010 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) (bleeding-botcc.rules)
2410011 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) (bleeding-botcc.rules)
2410012 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) (bleeding-botcc.rules)
2410013 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) (bleeding-botcc.rules)
2410014 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) (bleeding-botcc.rules)
2410015 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) (bleeding-botcc.rules)
2410016 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) (bleeding-botcc.rules)
2410017 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) (bleeding-botcc.rules)
2410018 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) (bleeding-botcc.rules)
2410019 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) (bleeding-botcc.rules)
2410020 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 21) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411008 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411009 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411010 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411011 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411012 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411013 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411014 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411015 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411016 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411017 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411018 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411019 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411020 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[---] Disabled rules: [---]

2001284 - BLEEDING-EDGE VIRUS Sober.F Outbound (1) (bleeding-virus.rules)
2001285 - BLEEDING-EDGE VIRUS Sober.F Outbound (2) (bleeding-virus.rules)
2001578 - BLEEDING-EDGE VIRUS Sober.I - outbound (bleeding-virus.rules)
2001750 - BLEEDING-EDGE VIRUS Sober.K Worm - outgoing (bleeding-virus.rules)
2001902 - BLEEDING-EDGE WORM Sober.O Attachment Outbound (2) (bleeding-virus.rules)
2001913 - BLEEDING-EDGE VIRUS Possible Sober.P Outbound (2) (bleeding-virus.rules)
2002055 - BLEEDING-EDGE WORM Sober.O Attachment Outbound (1) (bleeding-virus.rules)
2002057 - BLEEDING-EDGE WORM Sober.O Attachment Outbound (3) (bleeding-virus.rules)
2002059 - BLEEDING-EDGE VIRUS Possible Sober.P Outbound (1) (bleeding-virus.rules)
2002391 - BLEEDING-EDGE VIRUS CME-151 Sober.R SMTP Outbound (bleeding-virus.rules)
2002686 - BLEEDING-EDGE VIRUS Sober.AA (.Z,.AG,.X,.Y,.W) worm SMTP Outbound (bleeding-virus.rules)

[---] Removed rules: [---]

2001545 - BLEEDING-EDGE ATTACK RESPONSE Potential root shell connection detected! (bleeding-attack_response.rules)
2001717 - BLEEDING-EDGE ATTACK RESPONSE Successful user connection AFTER Brute Force Attack (bleeding-attack_response.rules)
3003147 - BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap) (bleeding-exploit.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-sid-msg.map (8):
2002668 || BLEEDING-EDGE WEB CutePHP CuteNews directory traversal vulnerability - show_news || bugtraq,15295
2003148 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap)
2003149 || BLEEDING-EDGE ATTACK RESPONSE Possible /etc/passwd via SMTP (linux style)
2003150 || BLEEDING-EDGE ATTACK RESPONSE Possible /etc/passwd via SMTP (BSD style)
2003151 || BLEEDING-EDGE Malware Fun Web Products SmileyCentral IEsp2 Install || url,www.myfuncards.com
2003152 || BLEEDING-EDGE WEB CutePHP CuteNews directory traversal vulnerability - show_archives || bugtraq,15295
2410021 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 22) || url,www.shadowserver.org
2411021 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 22) - BLOCKING SOURCE || url,www.shadowserver.org

[---] Removed non-rule lines: [---]

-> Removed from bleeding-attack_response.rules (4):
# Access to backdoor created by some SSL exploit
#No longer very useful. Disablnig, delete in the future
#By Matt Jonkman
# Still doesn't work, but we hope to figure out a way in the future...

-> Removed from bleeding-sid-msg.map (4):
2001545 || BLEEDING-EDGE ATTACK RESPONSE Potential root shell connection detected!
2001717 || BLEEDING-EDGE ATTACK RESPONSE Successful user connection AFTER Brute Force Attack
2002668 || BLEEDING-EDGE WEB CutePHP CuteNews directory traversal vulnerability || bugtraq,15295
3003147 || BLEEDING-EDGE EXPLOIT Novell HttpStk Remote Code Execution Attempt /nds (linewrap)

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-28 01:00

[***] Results from Oinkmaster started Fri Oct 27 21:00:08 2006 [***]

[+++] Added rules: [+++]

2003153 - BLEEDING-EDGE MALWARE Bestcount.net Spyware Exploit Download (bleeding-malware.rules)
2003154 - BLEEDING-EDGE MALWARE Bestcount.net Spyware Data Upload (bleeding-malware.rules)
2003155 - BLEEDING-EDGE CURRENT Microsoft TEREDO IPv6 tunneling (bleeding.rules)

[///] Modified active rules: [///]

2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) (bleeding-botcc.rules)
2410006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) (bleeding-botcc.rules)
2410007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) (bleeding-botcc.rules)
2410008 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) (bleeding-botcc.rules)
2410009 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411008 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411009 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[---] Removed rules: [---]

2410010 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) (bleeding-botcc.rules)
2410011 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) (bleeding-botcc.rules)
2410012 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) (bleeding-botcc.rules)
2410013 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) (bleeding-botcc.rules)
2410014 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) (bleeding-botcc.rules)
2410015 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) (bleeding-botcc.rules)
2410016 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) (bleeding-botcc.rules)
2410017 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) (bleeding-botcc.rules)
2410018 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) (bleeding-botcc.rules)
2410019 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) (bleeding-botcc.rules)
2410020 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 21) (bleeding-botcc.rules)
2410021 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 22) (bleeding-botcc.rules)
2411010 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411011 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411012 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411013 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411014 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411015 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411016 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411017 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411018 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411019 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411020 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411021 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 22) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-sid-msg.map (3):
2003153 || BLEEDING-EDGE MALWARE Bestcount.net Spyware Exploit Download || url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain
2003154 || BLEEDING-EDGE MALWARE Bestcount.net Spyware Data Upload || url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain
2003155 || BLEEDING-EDGE CURRENT Microsoft TEREDO IPv6 tunneling

-> Added to bleeding.rules (2):
#by Jef Kell
# Microsoft teredo tunnel

[---] Removed non-rule lines: [---]

-> Removed from bleeding-sid-msg.map (24):
2410010 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 11) || url,www.shadowserver.org
2410011 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 12) || url,www.shadowserver.org
2410012 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 13) || url,www.shadowserver.org
2410013 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 14) || url,www.shadowserver.org
2410014 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 15) || url,www.shadowserver.org
2410015 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 16) || url,www.shadowserver.org
2410016 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 17) || url,www.shadowserver.org
2410017 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 18) || url,www.shadowserver.org
2410018 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 19) || url,www.shadowserver.org
2410019 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 20) || url,www.shadowserver.org
2410020 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 21) || url,www.shadowserver.org
2410021 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 22) || url,www.shadowserver.org
2411010 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE || url,www.shadowserver.org
2411011 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE || url,www.shadowserver.org
2411012 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE || url,www.shadowserver.org
2411013 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE || url,www.shadowserver.org
2411014 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE || url,www.shadowserver.org
2411015 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE || url,www.shadowserver.org
2411016 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE || url,www.shadowserver.org
2411017 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE || url,www.shadowserver.org
2411018 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE || url,www.shadowserver.org
2411019 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE || url,www.shadowserver.org
2411020 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
2411021 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 22) - BLOCKING SOURCE || url,www.shadowserver.org

[Snort-sigs] Bleeding Edge Threats Daily Update

From: <bleeding@bl...> - 2006-10-31 01:00

[***] Results from Oinkmaster started Mon Oct 30 20:00:10 2006 [***]

[+++] Added rules: [+++]

2003156 - BLEEDING-EDGE WEB Crewbox Proxy Scan (bleeding-web.rules)

[///] Modified active rules: [///]

2003154 - BLEEDING-EDGE MALWARE Bestcount.net Spyware Data Upload (bleeding-malware.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1) (bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2) (bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3) (bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4) (bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5) (bleeding-botcc.rules)
2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6) (bleeding-botcc.rules)
2410006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7) (bleeding-botcc.rules)
2410007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8) (bleeding-botcc.rules)
2410008 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 9) (bleeding-botcc.rules)
2410009 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 10) (bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411008 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
2411009 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)

[+++] Added non-rule lines: [+++]

-> Added to bleeding-sid-msg.map (1):
2003156 || BLEEDING-EDGE WEB Crewbox Proxy Scan

-> Added to bleeding-web.rules (1):
# Submitted 2006-10-30 by Frank Knobbe

[Snort-sigs] SID:4135 False Positives

From: Siemens, Mike <Michael.Siemens@ej...> - 2006-10-27 20:34

Attachments: Message as HTML

We are receiving alerts on this rule (GEN:SID 1:4135 "WEB-CLIENT IE JPEG =
heap
overflow single packet attempt") on several legitimate web sites =
including
banks, customers, business partners and vendors. The data that I'm =
viewing in
BASE doesn't seem to indicate the jpeg file that is causing the alert. =
What
can I do to assist you in verifying that these are true or false =
positives?
=20
-Mike

[Snort-sigs] snort-inline and config detection: search-method

From: Christian Swartzbaugh <feofil@gm...> - 2006-10-27 23:14

For several search-methods, including the defaults, snort compiled
with inline does not drop in certain cases and in other cases does not
alert. It is not consistent across different search methods either.

snort 2.6.0.2 (with --enable-inline)
config detection: search-method ac-std
(and others)

drop any any -> any any (msg:"does not drop"; content:"12345";
threshold: type both, track by_src, limit 3, seconds 30; )

Different search methods seem to treat dropping all differently, can
anyone describe what the idea is here and why the different search
methods are causing problems for inline? or should I visit
snort-inline mailing lists.

feofil

Re: [Snort-sigs] snort-inline and config detection: search-method

From: Matthew Watchinski <mwatchinski@so...> - 2006-10-28 17:54

I would suggest removing your threshold statement and re-running your
test.

Cheers,
-matt

Christian Swartzbaugh wrote:
> For several search-methods, including the defaults, snort compiled
> with inline does not drop in certain cases and in other cases does not
> alert. It is not consistent across different search methods either.
>
> snort 2.6.0.2 (with --enable-inline)
> config detection: search-method ac-std
> (and others)
>
> drop any any -> any any (msg:"does not drop"; content:"12345";
> threshold: type both, track by_src, limit 3, seconds 30; )
>
>
> Different search methods seem to treat dropping all differently, can
> anyone describe what the idea is here and why the different search
> methods are causing problems for inline? or should I visit
> snort-inline mailing lists.
>
> feofil
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with -integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>

[Snort-sigs] Scan Fin

From: gary douglas <GM-Douglas@wi...> - 2006-10-27 21:09

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#

Rule:
Scan Fin
--
Sid:
621
--
Summary:

--
Impact:

--
Detailed Information:

--
Affected Systems:

--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:
Macintosh computers will send a fin in a packet alone if they do not
receive a reply to a syn packet.
--
False Negatives:

--
Corrective Action:

--
Contributors:

--
Additional References:

Thank you
Gary Douglas
(309) 298-3089
R&I, ResNet Administrator
University Computer Support Services
Western Illinois University

[Snort-sigs] High FP for sid 8428 (SSL get_shared_ciphers() overflow)

From: Jon Hart <jhart@sp...> - 2006-10-27 18:27

I've been seeing a non-trivial number of hits to this sig over the past
week or so. I believe I understand what the rule is looking for, but
I'm not sure I can think of ways it can false positive.

Has anyone else had this signature trigger, and have any thoughts as to
whether or not it was detecting an actual attack?

-jon

[Snort-sigs] False Positives

From: Maxwell Lutticken <mluttick@ke...> - 2006-10-26 13:07

Attachments: Message as HTML FalseFlux11.txt FalseFlux12.txt FalseFlux13.txt FalseFlux01.txt FalseFlux02.txt FalseFlux03.txt FalseFlux04.txt FalseFlux05.txt FalseFlux06.txt FalseFlux07.txt FalseFlux08.txt FalseFlux09.txt

MDAwIDogMTAgMDAgMDAgMDAgMDEgQUQgMDAgMDAgMTAgMDAgMDAgMDAgMTAgMDAgMDAgMDAgICAu
Li4uLi4uLi4uLi4uLi4uDQowMTAgOiAwNSA3MSAwMCAwMCAwMyBGNCAwMCAwMSA0MCAxMyAwMCAw
MCAxOSAwNiAwMCAwMSAgIC5xLi4uLi4uQC4uLi4uLi4NCjAyMCA6IDY5IEMyIDAwIDAxIDRBIEZC
IDAwIDAxIEE3IDk2IDAwIDAxIEQ0IDY0IDAwIDAyICAgaS4uLkouLi4uLi4uLmQuLg0KMDMwIDog
MzUgMTAgMDAgMDEgNzMgOTcgMDAgMDEgNEIgODYgMDAgMDEgNjQgQ0QgMDAgMDEgICA1Li4ucy4u
LksuLi5kLi4uDQowNDAgOiA1OSBDNSAwMCAwMSA1QyAzNyAwMCAwMSA0RCA1NiAwMCAwMSA2QyA1
NyAwMCAwMiAgIFkuLi5cNy4uTVYuLmxXLi4NCjA1MCA6IEFGIDk1IDAwIDAxIENGIEI0IDAwIDAx
IDQzIDRBIDAwIDAxIDQwIDU1IDAwIDAxICAgLi4uLi4uLi5DSi4uQFUuLg0KMDYwIDogNjQgOTgg
MDAgMDAgRjcgOUIgMDAgMDEgNUUgRUQgMDAgMDEgNzAgNjEgMDAgMDEgICBkLi4uLi4uLl4uLi5w
YS4uDQowNzAgOiA1RCAyOCAwMCAwMSA3MCA3QSAwMCAwMCAxQSBEOSAwMCAwMSA1RCBFRSAwMCAw
MiAgIF0oLi5wei4uLi4uLl0uLi4NCjA4MCA6IDFEIEY0IDAwIDAwIDk1IEYyIDAwIDAyIDE2IDk4
IDAwIDAxIDQ2IDFGIDAwIDAxICAgLi4uLi4uLi4uLi4uRi4uLg0KMDkwIDogNjcgOUYgMDAgMDAg
MkIgRTMgMDAgMDEgNTEgQjQgMDAgMDAgMEMgMjQgMDAgMDEgICBnLi4uKy4uLlEuLi4uJC4uDQow
YTAgOiA1MyA1QyAwMCAwMSA4RiA1RCAwMCAwMCA1MiA2NyAwMCAwMSA3MyBFQSAwMCAwMCAgIFNc
Li4uXS4uUmcuLnMuLi4NCjBiMCA6IDFGIDFEIDAwIDAxIDVBIEQ3IDAwIDAxIDVEIEQzIDAwIDAx
IDVEIEMyIDAwIDAwICAgLi4uLlouLi5dLi4uXS4uLg0KMGMwIDogMDMgMDAgMDAgMDEgQzEgRkIg
MDAgMDIgNzUgNEIgMDAgMDEgOUIgRkYgMDAgMDEgICAuLi4uLi4uLnVLLi4uLi4uDQowZDAgOiBF
NSA1QSAwMCAwMSAzOCA0MyAwMCAwMSA1MCA2NyAwMCAwMiAyQSBBQSAwMCAwMSAgIC5aLi44Qy4u
UGcuLiouLi4NCjBlMCA6IDU3IDQ5IDAwIDAxIDQ5IDM2IDAwIDAxIDVEIDAyIDAwIDAxIEVEIEFD
IDAwIDAxICAgV0kuLkk2Li5dLi4uLi4uLg0KMGYwIDogRkIgMzUgMDAgMDEgNEIgMEMgMDAgMDEg
NUQgM0UgMDAgMDEgNjAgODMgMDAgMDEgICAuNS4uSy4uLl0+Li5gLi4uDQoxMDAgOiA2NSBDOSAw
MCAwMSBEMiA3MiAwMCAwMCAwNiAyQiAwMCAwMSA1NyBDNyAwMCAwMSAgIGUuLi4uci4uLisuLlcu
Li4NCjExMCA6IDU1IDgyIDAwIDAxIDYyIDRGIDAwIDAxIEQzIEM1IDAwIDAxIDY0IDE5IDAwIDAx
ICAgVS4uLmJPLi4uLi4uZC4uLg0KMTIwIDogNTcgQzggMDAgMDIgNEMgMDkgMDAgMDIgMUEgMUYg
MDAgMDEgNDcgNzcgMDAgMDEgICBXLi4uTC4uLi4uLi5Hdy4uDQoxMzAgOiBDQSA4OSAwMCAwMSA4
NCBCOCAwMCAwMCA0NSA1RCAwMCAwMSA0QiA0OCAwMCAwMSAgIC4uLi4uLi4uRV0uLktILi4NCjE0
MCA6IDQxIDI4IDAwIDAxIDRDIEY2IDAwIDAxIDRDIEZDIDAwIDAxIDQwIDFBIDAwIDAwICAgQSgu
LkwuLi5MLi4uQC4uLg0KMTUwIDogMDQgMTMgMDAgMDAgMTAgMDAgMDAgMDAgMDMgN0UgMDAgMDAg
MDMgOTcgMDAgMDAgICAuLi4uLi4uLi5+Li4uLi4uDQoxNjAgOiAwMyBCQSAwMCAwMCAwMyBBNCAw
MCAwMCAwMyA5RSAwMCAwMCAwMyBCNiAwMCAwMCAgIC4uLi4uLi4uLi4uLi4uLi4NCjE3MCA6IDAz
IDhCIDAwIDAwIDAzIEM4IDAwIDAwIDAzIDZDIDAwIDAwIDAzIDgzIDAwIDAwICAgLi4uLi4uLi4u
bC4uLi4uLg0KMTgwIDogMDMgODMgMDAgMDAgMTAgMDAgMDAgMDAgMTAgMDAgMDAgMDAgMEIgREEg
MDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQoxOTAgOiAzMiBCOSAwMCAwMCA0MyAxMyAwMCAwMCAx
NSA3NyAwMCAwMCAwRCAxMiAwMCAwMCAgIDIuLi5DLi4uLncuLi4uLi4NCjFhMCA6IDBEIDhCIDAw
IDAwIDBBIEY3IDAwIDAwIDA3IEY5IDAwIDAwIDBDIDk5IDAwIDAwICAgLi4uLi4uLi4uLi4uLi4u
Lg0KMWIwIDogMTAgNzggMDAgMDAgMEQgRjQgMDAgMDAgMEYgQ0QgMDAgMDAgMDggRTkgMDAgMDAg
ICAueC4uLi4uLi4uLi4uLi4uDQoxYzAgOiAwQyAzMSAwMCAwMCAwQSA0MyAwMCAwMCAwQSAzRCAw
MCAwMCAwOCA5MCAwMCAwMCAgIC4xLi4uQy4uLj0uLi4uLi4NCjFkMCA6IDBEIDg1IDAwIDAwIDBC
IDk0IDAwIDAwIDI0IDMzIDAwIDAwIDEwIDA5IDAwIDAwICAgLi4uLi4uLi4kMy4uLi4uLg0KMWUw
IDogMEEgQzAgMDAgMDAgMzQgNzggMDAgMDAgMEEgQTcgMDAgMDAgMEUgNjQgMDAgMDAgICAuLi4u
NHguLi4uLi4uZC4uDQoxZjAgOiAwOSBDOCAwMCAwMCAwNSA1QSAwMCAwMCAwNiA0OCAwMCAwMCAw
OCBCOCAwMCAwMCAgIC4uLi4uWi4uLkguLi4uLi4NCjIwMCA6IDE3IDA0IDAwIDAwIDEwIDY0IDAw
IDAwIDEwIDAwIDAwIDAwIDEwIDAwIDQxIEVEICAgLi4uLi5kLi4uLi4uLi5BLg0KMjEwIDogNDEg
RUQgODEgRUQgNDEgRUQgODEgRUQgNDEgRUQgODEgRUQgNDEgRUQgODEgRUQgICBBLi4uQS4uLkEu
Li5BLi4uDQoyMjAgOiA4MSBFRCBBMSBGRiA4MSBBNCA4MSBBNCA0MSBFRCA4MSBBNCA4MSBBNCA4
MSBBNCAgIC4uLi4uLi4uQS4uLi4uLi4NCjIzMCA6IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgx
IEE0IDgxIEE0IDgxIEVEIEExIEZGICAgLi4uLi4uLi4uLi4uLi4uLg0KMjQwIDogODEgRUQgODEg
RUQgODEgRUQgODEgRUQgQTEgRkYgODEgRUQgODEgRUQgODEgRUQgICAuLi4uLi4uLi4uLi4uLi4u
DQoyNTAgOiA4MSBFRCA4MSBFRCA4MSBFRCA4MSBFRCA4MSBFRCA4MSBFRCA4MSBFRCA4MSBFRCAg
IC4uLi4uLi4uLi4uLi4uLi4NCjI2MCA6IDgxIEVEIDgxIEVEIDgxIEVEIDgxIEVEIDQxIEVEIDgx
IEE0IDgxIEE0IEExIEZGICAgLi4uLi4uLi5BLi4uLi4uLg0KMjcwIDogNDEgRUQgODEgQTQgODEg
QTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgNDEgRUQgICBBLi4uLi4uLi4uLi4uLkEuDQoyODAg
OiA0MSBFRCA4MSBBNCA4MSAyNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA0MSBFRCAgIEEuLi4u
JC4uLi4uLi4uQS4NCjI5MCA6IDQxIEVEIDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgx
IEE0IDgxIEE0ICAgQS4uLi4uLi4uLi4uLi4uLg0KMmEwIDogNDEgRUQgNDEgRUQgODEgQTQgODEg
QTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgICBBLkEuLi4uLi4uLi4uLi4uDQoyYjAgOiA4MSBB
NCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA0MSBFRCA0MSBFRCAgIC4uLi4uLi4uLi4u
LkEuQS4NCjJjMCA6IDgxIEE0IDgxIEE0IDQxIEVEIDQxIEVEIDgxIEE0IDgxIEE0IDgxIEE0IDQx
IEVEICAgLi4uLkEuQS4uLi4uLi5BLg0KMmQwIDogNDEgRUQgODEgQTQgODEgQTQgODEgQTQgNDEg
RUQgNDEgRUQgODEgQTQgODEgQTQgICBBLi4uLi4uLkEuQS4uLi4uDQoyZTAgOiA4MSBBNCA0MSBF
RCA0MSBFRCA4MSBBNCA4MSBBNCA4MSBBNCA0MSBFRCA0MSBFRCAgIC4uQS5BLi4uLi4uLkEuQS4N
CjJmMCA6IDgxIEE0IDgxIEE0IDgxIEE0IDQxIEVEIDQxIEVEIDgxIEE0IDgxIEE0IDgxIEE0ICAg
Li4uLi4uQS5BLi4uLi4uLg0KMzAwIDogNDEgRUQgODEgQTQgODEgQTQgNDEgRUQgNDEgRUQgODEg
QTQgODEgQTQgODEgQTQgICBBLi4uLi5BLkEuLi4uLi4uDQozMTAgOiA0MSBFRCA0MSBFRCA4MSBB
NCA4MSBBNCA4MSBBNCA0MSBFRCA0MSBFRCA4MSBBNCAgIEEuQS4uLi4uLi5BLkEuLi4NCjMyMCA6
IDgxIEE0IDgxIEE0IDQxIEVEIDQxIEVEIDQxIEVEIDQxIEVEIDgxIEE0IDQxIEVEICAgLi4uLkEu
QS5BLkEuLi5BLg0KMzMwIDogNDEgRUQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEg
QTQgODEgQTQgICBBLi4uLi4uLi4uLi4uLi4uDQozNDAgOiA4MSBBNCA4MSBBNCA4MSBBNCA4MSBB
NCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCAgIC4uLi4uLi4uLi4uLi4uLi4NCjM1MCA6IDgxIEE0
IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0ICAgLi4uLi4uLi4uLi4u
Li4uLg0KMzYwIDogODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEg
QTQgICAuLi4uLi4uLi4uLi4uLi4uDQozNzAgOiA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBB
NCA4MSBBNCA4MSBBNCA4MSBBNCAgIC4uLi4uLi4uLi4uLi4uLi4NCjM4MCA6IDgxIEE0IDgxIEE0
IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0ICAgLi4uLi4uLi4uLi4uLi4uLg0K
MzkwIDogODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgICAu
Li4uLi4uLi4uLi4uLi4uDQozYTAgOiA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBB
NCA4MSBBNCA4MSBBNCAgIC4uLi4uLi4uLi4uLi4uLi4NCjNiMCA6IDgxIEE0IDgxIEE0IDgxIEE0
IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0ICAgLi4uLi4uLi4uLi4uLi4uLg0KM2MwIDog
ODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgICAuLi4uLi4u
Li4uLi4uLi4uDQozZDAgOiA4MSBBNCA4MSBBNCA0MSBFRCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBB
NCA4MSBBNCAgIC4uLi5BLi4uLi4uLi4uLi4NCjNlMCA6IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0
IDgxIEE0IDgxIEE0IDQxIEVEIDQxIEVEICAgLi4uLi4uLi4uLi4uQS5BLg0KM2YwIDogODEgQTQg
ODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgICAuLi4uLi4uLi4uLi4u
Li4uDQo0MDAgOiA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBBNCA4MSBB
NCAgIC4uLi4uLi4uLi4uLi4uLi4NCjQxMCA6IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0IDgxIEE0
IDgxIEE0IDgxIEE0IDgxIEE0ICAgLi4uLi4uLi4uLi4uLi4uLg0KNDIwIDogODEgQTQgODEgQTQg
ODEgQTQgODEgQTQgODEgQTQgODEgQTQgODEgQTQgNDMgRjggICAuLi4uLi4uLi4uLi4uLkMuDQo0
MzAgOiA0MSBFRCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIEEu
Li4uLi4uLi4uLi4uLi4NCjQ0MCA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw
IDAwIDAwIDAwIDAwICAgLi4uLi4uLi4uLi4uLi4uLg0KNDUwIDogMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQo0NjAgOiAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4u
Li4uLi4uLi4NCjQ3MCA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw
IDAwIDAwICAgLi4uLi4uLi4uLi4uLi4uLg0KNDgwIDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQo0OTAgOiAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4uLi4uLi4u
Li4NCjRhMCA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAw
ICAgLi4uLi4uLi4uLi4uLi4uLg0KNGIwIDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgMDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQo0YzAgOiAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4uLi4uLi4uLi4NCjRk
MCA6IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAgLi4u
Li4uLi4uLi4uLi4uLg0KNGUwIDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgMDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQo0ZjAgOiAwMCAwMCAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4uLi4uLi4uLi4NCjUwMCA6IDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAgLi4uLi4uLi4u
Li4uLi4uLg0KNTEwIDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
MDAgMDAgICAuLi4uLi4uLi4uLi4uLi4uDQo1MjAgOiAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4uLi4uLi4uLi4NCjUzMCA6IDAwIDAwIDAw
IDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwIDAwICAgLi4uLi4uLi4uLi4uLi4u
Lg0KNTQwIDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAg
ICAuLi4uLi4uLi4uLi4uLi4uDQo1NTAgOiAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAwMCAw
MCAwMCAwMCAwMCAwMCAwMCAgIC4uLi4uLi4uLi4uLi4uLi4NCjU2MCA6IDAwIDAwIDAwIDAwICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uLg==

[Snort-sigs] Snort Community Rules Update

From: Sourcefire VRT <research@so...> - 2006-10-23 13:03

This message is to announce the availability of an update for the Sourcefire community rule set, which can be downloaded free of cost or registration from http://www.snort.org/pub-bin/downloads.cgi.

This release fixes a missing semicolon in SID 100000906, and uses improved PCRE for SIDs 100000272-100000278.

Sourcefire would like to thank both Monica Cloutier and <info@lucretia.ca> for pointing out the error with SID 100000906, and Blake Hartstein for submitting the improved PCRE for SIDs 100000272-100000278. As a reminder, anyone who wishes to submit rules may do so at http://www.snort.org/reg-bin/rulesubmit.cgi.

A list of modified rules and their SIDs follows.

Alex Kirk
Community Rules Maintainer
Sourcefire, Inc.

100000272 || COMMUNITY BOT GTBot ver command
100000273 || COMMUNITY BOT GTBot info command
100000274 || COMMUNITY BOT GTBot scan command
100000275 || COMMUNITY BOT GTBot portscan command
100000276 || COMMUNITY BOT GTBot stopscan command
100000277 || COMMUNITY BOT GTBot packet command
100000278 || COMMUNITY BOT GTBot bnc command
100000906 || COMMUNITY WEB-PHP UBB.threads remote file include

Re: [Snort-sigs] Snort Community Rules Update

From: info+lucretia.ca <info@lu...> - 2006-10-21 15:03

Please note:

The most recent community-web-php.rules has a typo that is missing a ';'.

I don't recall the exact rule but it was on line 450 of that rule file.

Cheers,

James Friesen, CIO
Lucretia Enterprises
Our World Is Here
info at lucretia dot ca
http://lucretia.ca

> -----Original Message-----
> From: snort-sigs-bounces@lists.sourceforge.net /> > [mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf
> Of Sourcefire VRT
> Sent: Friday, October 20, 2006 2:26 PM
> To: snort-sigs mailinglist
> Subject: [Snort-sigs] Snort Community Rules Update
>
> This message is to announce the availability of an update for
> the Sourcefire community rule set, which can be downloaded
> free of cost or registration from
> http://www.snort.org/pub-bin/downloads.cgi.
>
> New rules in this release are identified as SIDs 100000900-100000919.
> These rules cover detection of Mytob worm over IRC; remote
> file inclusion attacks against the UBB.threads, phpMyWebmin,
> Dayfox Blog, Somery, PHP-Dimension, and Segue CMS systems;
> and a cross-site scripting attack against the MyBulletinBoard system.
>
> Additionally, a large number of rules have been updated for
> improved performance and/or readability, including the
> addition of classtypes to all rules which viously lacked
> such information.
>
> Sourcefire would like to thank Shirkdog for submitting SID
> 100000919. As a reminder, anyone who wishes to submit rules
> may do so at http://www.snort.org/reg-bin/rulesubmit.cgi.
>
> A list of modified rules and their SIDs follows.
>
> Alex Kirk
> Community Rules Maintainer
> Sourcefire, Inc.
>
> New rules:
> 100000900 || COMMUNITY BOT Mytob IRC DCC file transfer request
> 100000901 || COMMUNITY BOT Mytob IRC DCC chat request
> 100000902 || COMMUNITY BOT Mytob IRC channel join
> 100000903 || COMMUNITY BOT Mytob IRC dns request
> 100000904 || COMMUNITY BOT Mytob IRC dns response
> 100000905 || COMMUNITY BOT Mytob IRC nick change
> 100000906 || COMMUNITY WEB-PHP UBB.threads remote file include
> 100000907 || COMMUNITY WEB-PHP phpMyWebmin
> change_ferences2 script remote file include
> 100000908 || COMMUNITY WEB-PHP phpMyWebmin create_file script
> remote file include
> 100000909 || COMMUNITY WEB-PHP phpMyWebmin upload_local
> script remote file include 100000910 || COMMUNITY WEB-PHP
> phpMyWebmin upload_multi script remote file include
> 100000911 || COMMUNITY WEB-PHP Dayfox Blog adminlog.php
> module remote file include
> 100000912 || COMMUNITY WEB-PHP Dayfox Blog postblog.php
> module remote file include
> 100000913 || COMMUNITY WEB-PHP Dayfox Blog index.php module
> remote file include
> 100000914 || COMMUNITY WEB-PHP Dayfox Blog index2.php module
> remote file include
> 100000915 || COMMUNITY WEB-PHP Somery Include.php remote file include
> 100000916 || COMMUNITY WEB-PHP MyBulletinBoard
> Functions_Post.php xss attempt
> 100000917 || COMMUNITY WEB-PHP PHP-Dimension functions_kb.php
> remote file include attempt
> 100000918 || COMMUNITY WEB-PHP PHP-Dimension
> themen_portal_mitte.php remote include attempt
> 100000919 || COMMUNITY WEB-PHP Segue CMS
> themesettings.inc.php remote file include attempt
>
> Updated rules:
> 100000187 || COMMUNITY WEB-PHP XSS attempt
> 100000189 || COMMUNITY MISC streaming RTSP - realplayer
> 100000190 || COMMUNITY MISC streaming Windows Mediaplayer
> 100000192 || COMMUNITY SQL-INJECTION WIZZ ForumTopicDetails
> Sql Injection attempt
> 100000193 || COMMUNITY SQL-INJECTION WIZZ ForumAuthDetails
> Sql Injection attempt
> 100000194 || COMMUNITY SQL-INJECTION WIZZ ForumReply Sql
> Injection attempt
> 100000215 || COMMUNITY DOS Trend Micro ServerProtect
> EarthAgent attempt
> 100000221 || COMMUNITY WEB-PHP AppServ main.php appserv_root
> param access
> 100000229 || COMMUNITY MISC Lotus Domino LDAP attack
> 100000237 || COMMUNITY WEB-MISC Proxy Bypass Via Google
> Translation Same To And From Language
> 100000284 || COMMUNITY WEB-CLIENT RealMedia invalid chunk
> size heap overflow attempt
> 100000285 || COMMUNITY WEB-PHP ldap_var.inc.php remote file
> include attempt
> 100000302 || COMMUNITY WEB-MISC DeviceSelection.asp
> sRedirectUrl parameter access
> 100000303 || COMMUNITY WEB-MISC DeviceSelection.asp
> sCancelURL parameter access
> 100000304 || COMMUNITY WEB-PHP Gphoto index.php rep parameter
> remote file include attempt
> 100000305 || COMMUNITY WEB-PHP Gphoto index.php image
> parameter remote file include attempt
> 100000306 || COMMUNITY WEB-PHP Gphoto diapho.php rep
> parameter remote file include attempt
> 100000307 || COMMUNITY WEB-PHP Gphoto diapho.php image
> parameter remote file include attempt
> 100000308 || COMMUNITY WEB-PHP Gphoto affich.php rep
> parameter remote file include attempt
> 100000309 || COMMUNITY WEB-PHP Gphoto affich.php image
> parameter remote file include attempt
> 100000312 || COMMUNITY VIRUS Ginwui.B POST attempt
> 100000317 || COMMUNITY WEB-MISC phpBazar classified_right.php
> remote file include
> 100000318 || COMMUNITY WEB-MISC phpBazar admin.php remote file include
> 100000319 || COMMUNITY WEB-MISC ActualScripts direct.php
> remote file include 100000320 || COMMUNITY WEB-MISC ScozNet
> ScozNews functions.php remote file include
> 100000321 || COMMUNITY WEB-MISC ScozNet ScozNews help.php
> remote file include
> 100000322 || COMMUNITY WEB-MISC ScozNet ScozNews mail.php
> remote file include
> 100000323 || COMMUNITY WEB-MISC ScozNet ScozNews news.php
> remote file include
> 100000324 || COMMUNITY WEB-MISC ScozNet ScozNews template.php
> remote file include
> 100000325 || COMMUNITY WEB-MISC ScozNet ScozNews
> admin_cats.php remote file include
> 100000326 || COMMUNITY WEB-MISC ScozNet ScozNews
> admin_edit.php remote file include
> 100000327 || COMMUNITY WEB-MISC ScozNet ScozNews
> admin_import.php remote file include
> 100000328 || COMMUNITY WEB-MISC ScozNet ScozNews
> admin_templates.php remote file include
> 100000329 || COMMUNITY WEB-MISC Invision Power Board
> class_post.php remote file include 100000330 || COMMUNITY
> WEB-MISC Invision Power Board moderate.php remote file include
> 100000334 || COMMUNITY WEB-MISC CaLogic Calendars
> reconfig.php remote file include
> 100000335 || COMMUNITY WEB-MISC CaLogic Calendars srxclr.php
> remote file include
> 100000336 || COMMUNITY WEB-MISC phpMyDirectory footer.php
> remote file include
> 100000337 || COMMUNITY WEB-MISC phpMyDirectory
> defaults_setup.php remote file include
> 100000338 || COMMUNITY WEB-MISC phpMyDirectory header.php
> remote file include
> 100000339 || COMMUNITY WEB-MISC V-Webmail core.php remote
> file include 100000340 || COMMUNITY WEB-MISC V-Webmail
> pop3.php remote file include
> 100000341 || COMMUNITY WEB-MISC DoceboLMS help.php remote file include
> 100000342 || COMMUNITY WEB-MISC DoceboLMS business.php remote
> file include
> 100000343 || COMMUNITY WEB-MISC DoceboLMS credits.php remote
> file include
> 100000344 || COMMUNITY WEB-MISC SocketMail index.php remote
> file include
> 100000345 || COMMUNITY WEB-MISC SocketMail inc-common.php
> remote file include
> 100000346 || COMMUNITY WEB-MISC Plume CMS pend.php remote
> file include
> 100000347 || COMMUNITY WEB-MISC Ezupload Pro form.php remote
> file include
> 100000348 || COMMUNITY WEB-MISC Ezupload Pro customize.php
> remote file include
> 100000349 || COMMUNITY WEB-MISC Ezupload Pro initialize.php
> remote file include 100000350 || COMMUNITY WEB-MISC
> UBBThreads ubbt.inc.php remote file include
> 100000351 || COMMUNITY WEB-MISC UBBThreads
> config[cookiefix] remote file include
> 100000352 || COMMUNITY WEB-MISC Blend Portal blend_common.php
> remote file include
> 100000353 || COMMUNITY WEB-MISC tinyBB footers.php remote file include
> 100000354 || COMMUNITY WEB-MISC phpBB-Amod lang_activity.php
> remote file include
> 100000355 || COMMUNITY WEB-MISC eSyndiCat cron.php remote file include
> 100000356 || COMMUNITY WEB-MISC BASE base_qry_common.php
> remote file include
> 100000357 || COMMUNITY WEB-MISC BASE base_stat_common.php
> remote file include
> 100000358 || COMMUNITY WEB-MISC BASE base_include.inc.php
> remote file include
> 100000359 || COMMUNITY WEB-MISC Fastpublish CMS drucken.php
> remote file include 100000360 || COMMUNITY WEB-MISC
> Fastpublish CMS drucken2.php remote file include
> 100000361 || COMMUNITY WEB-MISC Fastpublish CMS
> email_an_benutzer.php remote file include
> 100000362 || COMMUNITY WEB-MISC Fastpublish CMS rechnung.php
> remote file include
> 100000363 || COMMUNITY WEB-MISC Fastpublish CMS search.php
> remote file include
> 100000364 || COMMUNITY WEB-MISC Fastpublish CMS admin.php
> remote file include
> 100000365 || COMMUNITY WEB-MISC phpNuke index.php remote file include
> 100000366 || COMMUNITY WEB-MISC phpNuke admin_ug_auth.php
> remote file include
> 100000367 || COMMUNITY WEB-MISC phpNuke admin_board.php
> remote file include
> 100000368 || COMMUNITY WEB-MISC phpNuke admin_disallow.php
> remote file include
> 100000369 || COMMUNITY WEB-MISC phpNuke admin_forumauth.php
> remote file include 100000370 || COMMUNITY WEB-MISC phpNuke
> admin_groups.php remote file include
> 100000371 || COMMUNITY WEB-MISC phpNuke admin_ranks.php
> remote file include
> 100000372 || COMMUNITY WEB-MISC phpNuke admin_styles.php
> remote file include
> 100000373 || COMMUNITY WEB-MISC phpNuke admin_user_ban.php
> remote file include
> 100000374 || COMMUNITY WEB-MISC phpNuke admin_words.php
> remote file include
> 100000375 || COMMUNITY WEB-MISC phpNuke admin_avatar.php
> remote file include
> 100000376 || COMMUNITY WEB-MISC phpNuke
> admin_db_utilities.php remote file include
> 100000377 || COMMUNITY WEB-MISC phpNuke admin_forum_prune.php
> remote file include
> 100000378 || COMMUNITY WEB-MISC phpNuke admin_forums.php
> remote file include
> 100000379 || COMMUNITY WEB-MISC phpNuke admin_mass_email.php
> remote file include 100000380 || COMMUNITY WEB-MISC phpNuke
> admin_smilies.php remote file include
> 100000381 || COMMUNITY WEB-MISC phpNuke admin_ug_auth.php
> remote file include
> 100000382 || COMMUNITY WEB-MISC phpNuke admin_users.php
> remote file include
> 100000383 || COMMUNITY WEB-MISC OsTicket open_form.php remote
> file include
> 100000384 || COMMUNITY WEB-MISC Ottoman index.php remote file include
> 100000385 || COMMUNITY WEB-MISC Ottoman error.php remote file include
> 100000386 || COMMUNITY WEB-MISC Ottoman main_class.php remote
> file include
> 100000387 || COMMUNITY WEB-MISC Ovidentia index.php remote
> file include
> 100000388 || COMMUNITY WEB-MISC Ovidentia topman.php remote
> file include
> 100000389 || COMMUNITY WEB-MISC Ovidentia approb.php remote
> file include 100000390 || COMMUNITY WEB-MISC Ovidentia
> vacadmb.php remote file include
> 100000391 || COMMUNITY WEB-MISC Ovidentia vacadma.php remote
> file include
> 100000392 || COMMUNITY WEB-MISC Ovidentia vacadm.php remote
> file include
> 100000393 || COMMUNITY WEB-MISC Ovidentia start.php remote
> file include
> 100000394 || COMMUNITY WEB-MISC Ovidentia search.php remote
> file include
> 100000395 || COMMUNITY WEB-MISC Ovidentia posts.php remote
> file include
> 100000396 || COMMUNITY WEB-MISC Ovidentia options.php remote
> file include
> 100000397 || COMMUNITY WEB-MISC Ovidentia login.php remote
> file include
> 100000398 || COMMUNITY WEB-MISC Ovidentia frchart.php remote
> file include
> 100000399 || COMMUNITY WEB-MISC Ovidentia flbchart.php remote
> file include 100000400 || COMMUNITY WEB-MISC Ovidentia
> fileman.php remote file include
> 100000401 || COMMUNITY WEB-MISC Ovidentia faq.php remote file include
> 100000402 || COMMUNITY WEB-MISC Ovidentia event.php remote
> file include
> 100000403 || COMMUNITY WEB-MISC Ovidentia directory.php
> remote file include
> 100000404 || COMMUNITY WEB-MISC Ovidentia articles.php remote
> file include
> 100000405 || COMMUNITY WEB-MISC Ovidentia artedit.php remote
> file include
> 100000406 || COMMUNITY WEB-MISC Ovidentia approb.php remote
> file include
> 100000407 || COMMUNITY WEB-MISC Ovidentia calday.php remote
> file include
> 100000408 || COMMUNITY WEB-MISC AssoCIateD cache_mngt.php
> remote file include
> 100000409 || COMMUNITY WEB-MISC AssoCIateD
> gallery_functions.php remote file include 100000410 ||
> COMMUNITY WEB-MISC REDAXO index.inc.php remote file include
> 100000411 || COMMUNITY WEB-MISC REDAXO index.inc.php remote
> file include
> 100000412 || COMMUNITY WEB-MISC REDAXO index.inc.php remote
> file include
> 100000413 || COMMUNITY WEB-MISC REDAXO index.inc.php remote
> file include
> 100000414 || COMMUNITY WEB-MISC REDAXO community.inc.php
> remote file include
> 100000415 || COMMUNITY WEB-MISC Bytehoard server.php remote
> file include
> 100000416 || COMMUNITY WEB-MISC MyBloggie admin.php remote
> file include
> 100000417 || COMMUNITY WEB-MISC MyBloggie scode.php remote
> file include
> 100000418 || COMMUNITY WEB-MISC Ashwebstudio Ashnews
> ashheadlines.php remote file include
> 100000419 || COMMUNITY WEB-MISC Ashwebstudio Ashnews
> ashnews.php remote file include 100000420 || COMMUNITY
> WEB-MISC Informium common-menu.php remote file include
> 100000421 || COMMUNITY WEB-MISC Igloo wiki.php remote file include
> 100000422 || COMMUNITY WEB-MISC phpBB template.php remote file include
> 100000423 || COMMUNITY WEB-MISC DotWidget CMS index.php
> remote file include
> 100000424 || COMMUNITY WEB-MISC DotWidget CMS feedback.php
> remote file include
> 100000425 || COMMUNITY WEB-MISC DotWidget CMS
> printfriendly.php remote file include
> 100000426 || COMMUNITY WEB-MISC DotClear pend.php remote
> file include 100000430 || COMMUNITY WEB-MISC BlueShoes
> Bs_Faq.class.php remote file include
> 100000431 || COMMUNITY WEB-MISC BlueShoes
> fileBrowserInner.php remote file include
> 100000432 || COMMUNITY WEB-MISC BlueShoes file.php remote file include
> 100000433 || COMMUNITY WEB-MISC BlueShoes viewer.php remote
> file include
> 100000434 || COMMUNITY WEB-MISC BlueShoes
> Bs_ImageArchive.class.php remote file include
> 100000435 || COMMUNITY WEB-MISC BlueShoes
> Bs_Ml_User.class.php remote file include
> 100000436 || COMMUNITY WEB-MISC BlueShoes
> Bs_Wse_Profile.class.php remote file include
> 100000437 || COMMUNITY WEB-MISC CS-Cart
> class.cs_phpmailer.php remote file include
> 100000438 || COMMUNITY WEB-MISC Claroline mambo.inc.php
> remote file include
> 100000439 || COMMUNITY WEB-MISC Claroline postnuke.inc.php
> remote file include 100000440 || COMMUNITY WEB-MISC CyBoards
> common.php remote file include
> 100000441 || COMMUNITY WEB-MISC Wikiwig wk_lang.php remote
> file include
> 100000442 || COMMUNITY WEB-MISC MiraksGalerie pcltar.lib.php
> remote file include
> 100000443 || COMMUNITY WEB-MISC MiraksGalerie
> galimage.lib.php remote file include
> 100000444 || COMMUNITY WEB-MISC MiraksGalerie
> galsecurity.lib.php remote file include
> 100000463 || COMMUNITY WEB-PHP Joomla joomla.php remote file include
> 100000464 || COMMUNITY WEB-PHP LoveCompass AEPartner
> design.inc.php remote file include
> 100000465 || COMMUNITY WEB-PHP Empris sql_fcnsOLD.php remote
> file include
> 100000466 || COMMUNITY WEB-PHP Free QBoard post.php remote
> file include
> 100000467 || COMMUNITY WEB-PHP WebprojectDB nav.php remote
> file include
> 100000468 || COMMUNITY WEB-PHP WebprojectDB lang.php remote
> file include 100000470 || COMMUNITY WEB-PHP Foing
> manage_songs.php remote file include
> 100000478 || COMMUNITY WEB-PHP aWebNews visview.php remote
> file include
> 100000479 || COMMUNITY WEB-PHP CzarNews headlines.php remote
> file include 100000480 || COMMUNITY WEB-PHP Somery team.php
> remote file include
> 100000481 || COMMUNITY WEB-PHP Hinton Design PHPHG signed.php
> remote file include
> 100000482 || COMMUNITY WEB-PHP BoastMachine vote.php remote
> file include
> 100000483 || COMMUNITY WEB-PHP Wheatblog view_links.php
> remote file include
> 100000485 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include
> 100000486 || COMMUNITY WEB-PHP PhpBlueDragon CMS template.php
> remote file include
> 100000487 || COMMUNITY WEB-PHP ISPConfig server.inc.php
> remote file include
> 100000488 || COMMUNITY WEB-PHP ISPConfig app.inc.php remote
> file include
> 100000489 || COMMUNITY WEB-PHP ISPConfig login.php remote
> file include 100000490 || COMMUNITY WEB-PHP ISPConfig
> trylogin.php remote file include
> 100000491 || COMMUNITY WEB-PHP DeluxeBB posting.php remote
> file include
> 100000492 || COMMUNITY WEB-PHP DeluxeBB newpm.php remote file include
> 100000493 || COMMUNITY WEB-PHP DeluxeBB postreply.php remote
> file include
> 100000499 || COMMUNITY WEB-PHP PictureDis thumstbl.php remote
> file include 100000500 || COMMUNITY WEB-PHP PictureDis
> wpfiles.php remote file include
> 100000501 || COMMUNITY WEB-PHP PictureDis wallpapr.php remote
> file include
> 100000502 || COMMUNITY WEB-PHP Ji-Takz tag.class.php remote
> file include
> 100000503 || COMMUNITY WEB-PHP Nucleus CMS action.php remote
> file include
> 100000504 || COMMUNITY WEB-PHP Nucleus CMS media.php remote
> file include
> 100000505 || COMMUNITY WEB-PHP Nucleus CMS server.php remote
> file include
> 100000506 || COMMUNITY WEB-PHP Nucleus CMS
> api_metaweblog.inc.php remote file include
> 100000507 || COMMUNITY WEB-PHP FlashChat adminips.php remote
> file include
> 100000509 || COMMUNITY WEB-PHP RahnemaCo page.php remote file include
> 100000518 || COMMUNITY WEB-PHP PHP Live Helper initiate.php
> remote file include
> 100000524 || COMMUNITY WEB-PHP Micro CMS microcms-include.php
> remote file include
> 100000545 || COMMUNITY WEB-PHP PHP Blue Dragon CMS
> team_admin.php remote file include
> 100000546 || COMMUNITY WEB-PHP PHP Blue Dragon CMS
> rss_admin.php remote file include
> 100000547 || COMMUNITY WEB-PHP PHP Blue Dragon CMS
> manual_admin.php remote file include
> 100000548 || COMMUNITY WEB-PHP PHP Blue Dragon CMS
> forum_admin.php remote file include
> 100000552 || COMMUNITY WEB-PHP SmartSiteCMS inc_foot.php
> remote file include
> 100000553 || COMMUNITY WEB-PHP PHPMySMS gateway.php remote
> file include 100000560 || COMMUNITY WEB-PHP eNpaper1
> root_header.php remote file include
> 100000569 || COMMUNITY WEB-PHP Indexu app_change_email.php
> remote file include 100000570 || COMMUNITY WEB-PHP Indexu
> app_change_pwd.php remote file include
> 100000571 || COMMUNITY WEB-PHP Indexu app_mod_rewrite.php
> remote file include
> 100000572 || COMMUNITY WEB-PHP Indexu app_page_caching.php
> remote file include
> 100000573 || COMMUNITY WEB-PHP Indexu app_setup.php remote
> file include
> 100000574 || COMMUNITY WEB-PHP Indexu cat_add.php remote file include
> 100000575 || COMMUNITY WEB-PHP Indexu cat_delete.php remote
> file include
> 100000576 || COMMUNITY WEB-PHP Indexu cat_edit.php remote file include
> 100000577 || COMMUNITY WEB-PHP Indexu cat_path_update.php
> remote file include
> 100000578 || COMMUNITY WEB-PHP Indexu cat_search.php remote
> file include
> 100000579 || COMMUNITY WEB-PHP Indexu cat_struc.php remote
> file include 100000580 || COMMUNITY WEB-PHP Indexu
> cat_view.php remote file include
> 100000581 || COMMUNITY WEB-PHP Indexu cat_view_hidden.php
> remote file include
> 100000582 || COMMUNITY WEB-PHP Indexu cat_view_hierarchy.php
> remote file include
> 100000583 || COMMUNITY WEB-PHP Indexu
> cat_view_registered_only.php remote file include
> 100000584 || COMMUNITY WEB-PHP Indexu checkurl_web.php remote
> file include
> 100000585 || COMMUNITY WEB-PHP Indexu db_alter.php remote file include
> 100000586 || COMMUNITY WEB-PHP Indexu db_alter_change.php
> remote file include
> 100000587 || COMMUNITY WEB-PHP Indexu db_backup.php remote
> file include
> 100000588 || COMMUNITY WEB-PHP Indexu db_export.php remote
> file include
> 100000589 || COMMUNITY WEB-PHP Indexu db_import.php remote
> file include 100000590 || COMMUNITY WEB-PHP Indexu
> editor_add.php remote file include
> 100000591 || COMMUNITY WEB-PHP Indexu editor_delete.php
> remote file include
> 100000592 || COMMUNITY WEB-PHP Indexu editor_validate.php
> remote file include
> 100000593 || COMMUNITY WEB-PHP Indexu head.php remote file include
> 100000594 || COMMUNITY WEB-PHP Indexu index.php remote file include
> 100000595 || COMMUNITY WEB-PHP Indexu inv_config.php remote
> file include
> 100000596 || COMMUNITY WEB-PHP Indexu inv_config_payment.php
> remote file include
> 100000597 || COMMUNITY WEB-PHP Indexu inv_create.php remote
> file include
> 100000598 || COMMUNITY WEB-PHP Indexu inv_delete.php remote
> file include
> 100000599 || COMMUNITY WEB-PHP Indexu inv_edit.php remote
> file include 100000600 || COMMUNITY WEB-PHP Indexu
> inv_markpaid.php remote file include
> 100000601 || COMMUNITY WEB-PHP Indexu inv_markunpaid.php
> remote file include
> 100000602 || COMMUNITY WEB-PHP Indexu inv_overdue.php remote
> file include
> 100000603 || COMMUNITY WEB-PHP Indexu inv_paid.php remote file include
> 100000604 || COMMUNITY WEB-PHP Indexu inv_send.php remote file include
> 100000605 || COMMUNITY WEB-PHP Indexu inv_unpaid.php remote
> file include
> 100000606 || COMMUNITY WEB-PHP Indexu lang_modify.php remote
> file include
> 100000607 || COMMUNITY WEB-PHP Indexu link_add.php remote file include
> 100000608 || COMMUNITY WEB-PHP Indexu link_bad.php remote file include
> 100000609 || COMMUNITY WEB-PHP Indexu link_bad_delete.php
> remote file include 100000610 || COMMUNITY WEB-PHP Indexu
> link_checkurl.php remote file include
> 100000611 || COMMUNITY WEB-PHP Indexu link_delete.php remote
> file include
> 100000612 || COMMUNITY WEB-PHP Indexu link_duplicate.php
> remote file include
> 100000613 || COMMUNITY WEB-PHP Indexu link_edit.php remote
> file include
> 100000614 || COMMUNITY WEB-PHP Indexu
> link_mium_listing.php remote file include
> 100000615 || COMMUNITY WEB-PHP Indexu
> link_mium_sponsored.php remote file include
> 100000616 || COMMUNITY WEB-PHP Indexu link_search.php remote
> file include
> 100000617 || COMMUNITY WEB-PHP Indexu
> link_sponsored_listing.php remote file include
> 100000618 || COMMUNITY WEB-PHP Indexu link_validate.php
> remote file include
> 100000619 || COMMUNITY WEB-PHP Indexu link_validate_edit.php
> remote file include 100000620 || COMMUNITY WEB-PHP Indexu
> link_view.php remote file include
> 100000621 || COMMUNITY WEB-PHP Indexu log_search.php remote
> file include
> 100000622 || COMMUNITY WEB-PHP Indexu mail_modify.php remote
> file include
> 100000623 || COMMUNITY WEB-PHP Indexu menu.php remote file include
> 100000624 || COMMUNITY WEB-PHP Indexu message_create.php
> remote file include
> 100000625 || COMMUNITY WEB-PHP Indexu message_delete.php
> remote file include
> 100000626 || COMMUNITY WEB-PHP Indexu message_edit.php remote
> file include
> 100000627 || COMMUNITY WEB-PHP Indexu message_send.php remote
> file include
> 100000628 || COMMUNITY WEB-PHP Indexu message_subscriber.php
> remote file include
> 100000629 || COMMUNITY WEB-PHP Indexu message_view.php remote
> file include 100000630 || COMMUNITY WEB-PHP Indexu
> review_validate.php remote file include
> 100000631 || COMMUNITY WEB-PHP Indexu
> review_validate_edit.php remote file include
> 100000632 || COMMUNITY WEB-PHP Indexu summary.php remote file include
> 100000633 || COMMUNITY WEB-PHP Indexu template_active.php
> remote file include
> 100000634 || COMMUNITY WEB-PHP Indexu template_add_custom.php
> remote file include
> 100000635 || COMMUNITY WEB-PHP Indexu template_delete.php
> remote file include
> 100000636 || COMMUNITY WEB-PHP Indexu
> template_delete_file.php remote file include
> 100000637 || COMMUNITY WEB-PHP Indexu template_duplicate.php
> remote file include
> 100000638 || COMMUNITY WEB-PHP Indexu template_export.php
> remote file include
> 100000639 || COMMUNITY WEB-PHP Indexu template_import.php
> remote file include 100000640 || COMMUNITY WEB-PHP Indexu
> template_manager.php remote file include
> 100000641 || COMMUNITY WEB-PHP Indexu template_modify.php
> remote file include
> 100000642 || COMMUNITY WEB-PHP Indexu
> template_modify_file.php remote file include
> 100000643 || COMMUNITY WEB-PHP Indexu template_rename.php
> remote file include
> 100000644 || COMMUNITY WEB-PHP Indexu user_add.php remote file include
> 100000645 || COMMUNITY WEB-PHP Indexu user_delete.php remote
> file include
> 100000646 || COMMUNITY WEB-PHP Indexu user_edit.php remote
> file include
> 100000647 || COMMUNITY WEB-PHP Indexu user_search.php remote
> file include
> 100000648 || COMMUNITY WEB-PHP Indexu whos.php remote file include
> 100000666 || COMMUNITY WEB-PHP Harpia files.php remote file include
> 100000667 || COMMUNITY WEB-PHP Harpia files.php remote file include
> 100000668 || COMMUNITY WEB-PHP Harpia pheader.php remote file include
> 100000669 || COMMUNITY WEB-PHP Harpia headlines.php remote
> file include 100000670 || COMMUNITY WEB-PHP Harpia
> web_statsConfig.php remote file include
> 100000671 || COMMUNITY WEB-PHP Harpia load.php remote file include
> 100000672 || COMMUNITY WEB-PHP Harpia users.php remote file include
> 100000673 || COMMUNITY WEB-PHP Harpia web_statsConfig.php
> remote file include
> 100000674 || COMMUNITY WEB-PHP Harpia footer.php remote file include
> 100000675 || COMMUNITY WEB-PHP Harpia pfooter.php remote file include
> 100000676 || COMMUNITY WEB-PHP Harpia missing.php remote file include
> 100000677 || COMMUNITY WEB-PHP Harpia topics.php remote file include
> 100000678 || COMMUNITY WEB-PHP Harpia header.php remote file include
> 100000679 || COMMUNITY WEB-PHP Harpia index.php remote file
> include 100000680 || COMMUNITY WEB-PHP Harpia search.php
> remote file include
> 100000681 || COMMUNITY WEB-PHP Harpia header.php remote file include
> 100000682 || COMMUNITY WEB-PHP Harpia email.php remote file include
> 100000686 || COMMUNITY DOS EnergyMech parse_notice
> vulnerability - inbound
> 100000687 || COMMUNITY DOS EnergyMech parse_notice
> vulnerability - outbound
> 100000688 || COMMUNITY POLICY Ajax Remote Desktop Connection
> 100000690 || COMMUNITY SQL-INJECTION BXCP Sql Injection attempt
> 100000691 || COMMUNITY SQL-INJECTION Diesel Joke Script Sql
> Injection attempt
> 100000692 || COMMUNITY WEB-CLIENT midi file download attempt
> 100000693 || COMMUNITY WEB-CLIENT winamp midi file header
> overflow attempt
> 100000703 || COMMUNITY WEB-PHP Horde index.php show XSS attempt
> 100000704 || COMMUNITY WEB-PHP SmartSiteCMS comment.php
> remote file include
> 100000705 || COMMUNITY WEB-PHP SmartSiteCMS test.php remote
> file include
> 100000706 || COMMUNITY WEB-PHP SmartSiteCMS index.php remote
> file include
> 100000707 || COMMUNITY WEB-PHP SmartSiteCMS inc_adminfoot.php
> remote file include
> 100000708 || COMMUNITY WEB-PHP SmartSiteCMS comedit.php
> remote file include
> 100000711 || COMMUNITY WEB-PHP PHPRaid raids.php remote file include
> 100000712 || COMMUNITY WEB-PHP PHPRaid register.php remote
> file include
> 100000713 || COMMUNITY WEB-PHP PHPRaid roster.php remote file include
> 100000714 || COMMUNITY WEB-PHP PHPRaid view.php remote file include
> 100000715 || COMMUNITY WEB-PHP PHPRaid logs.php remote file include
> 100000716 || COMMUNITY WEB-PHP PHPRaid users.php remote file include
> 100000717 || COMMUNITY WEB-PHP PHPRaid configuration.php
> remote file include
> 100000718 || COMMUNITY WEB-PHP PHPRaid guilds.php remote file include
> 100000719 || COMMUNITY WEB-PHP PHPRaid index.php remote file
> include 100000720 || COMMUNITY WEB-PHP PHPRaid locations.php
> remote file include
> 100000721 || COMMUNITY WEB-PHP PHPRaid login.php remote file include
> 100000722 || COMMUNITY WEB-PHP PHPRaid lua_output.php remote
> file include
> 100000723 || COMMUNITY WEB-PHP PHPRaid permissions.php remote
> file include
> 100000724 || COMMUNITY WEB-PHP PHPRaid profile.php remote file include
> 100000728 || COMMUNITY WEB-PHP Geeklog functions.inc remote
> file include
> 100000729 || COMMUNITY WEB-PHP Geeklog functions.inc remote
> file include 100000730 || COMMUNITY WEB-PHP Geeklog
> BlackList.Examine.class.php remote file include
> 100000731 || COMMUNITY WEB-PHP Geeklog
> DeleteComment.Action.class.php remote file include
> 100000732 || COMMUNITY WEB-PHP Geeklog
> EditIPofURL.Admin.class.php remote file include
> 100000733 || COMMUNITY WEB-PHP Geeklog
> MTBlackList.Examine.class.php remote file include
> 100000734 || COMMUNITY WEB-PHP Geeklog
> MassDelete.Admin.class.php remote file include
> 100000735 || COMMUNITY WEB-PHP Geeklog
> MailAdmin.Action.class.php remote file include
> 100000736 || COMMUNITY WEB-PHP Geeklog
> MassDelTrackback.Admin.class.php remote file include
> 100000737 || COMMUNITY WEB-PHP Geeklog
> EditHeader.Admin.class.php remote file include
> 100000738 || COMMUNITY WEB-PHP Geeklog EditIP.Admin.class.php
> remote file include
> 100000739 || COMMUNITY WEB-PHP Geeklog
> IPofUrl.Examine.class.php remote file include 100000740 ||
> COMMUNITY WEB-PHP Geeklog Import.Admin.class.php remote file include
> 100000741 || COMMUNITY WEB-PHP Geeklog
> LogView.Admin.class.php remote file include
> 100000742 || COMMUNITY WEB-PHP Geeklog functions.inc remote
> file include
> 100000743 || COMMUNITY WEB-PHP Plume CMS dbinstall.php remote
> file include
> 100000746 || COMMUNITY WEB-PHP Randshop header.inc.php remote
> file include
> 100000747 || COMMUNITY WEB-PHP Plume CMS index.php remote file include
> 100000748 || COMMUNITY WEB-PHP Plume CMS rss.php remote file include
> 100000749 || COMMUNITY WEB-PHP Plume CMS search.php remote
> file include 100000750 || COMMUNITY WEB-PHP Free QBoard
> index.php remote file include
> 100000751 || COMMUNITY WEB-PHP Free QBoard about.php remote
> file include
> 100000752 || COMMUNITY WEB-PHP Free QBoard contact.php remote
> file include
> 100000753 || COMMUNITY WEB-PHP Free QBoard delete.php remote
> file include
> 100000754 || COMMUNITY WEB-PHP Free QBoard faq.php remote file include
> 100000755 || COMMUNITY WEB-PHP Free QBoard features.php
> remote file include
> 100000756 || COMMUNITY WEB-PHP Free QBoard history.php remote
> file include
> 100000762 || COMMUNITY WEB-PHP Randshop index.php remote file include
> 100000764 || COMMUNITY WEB-PHP MyPHP CMS global_header.php
> remote file include
> 100000766 || COMMUNITY WEB-PHP Blog CMS thumb.php remote file
> include 100000790 || COMMUNITY WEB-PHP Pivot edit_new.php
> remote file include
> 100000802 || COMMUNITY WEB-PHP BosClassifieds index.php
> remote file include
> 100000803 || COMMUNITY WEB-PHP BosClassifieds recent.php
> remote file include
> 100000804 || COMMUNITY WEB-PHP BosClassifieds account.php
> remote file include
> 100000805 || COMMUNITY WEB-PHP BosClassifieds classified.php
> remote file include
> 100000806 || COMMUNITY WEB-PHP BosClassifieds search.php
> remote file include
> 100000809 || COMMUNITY WEB-PHP RW Download stats.php remote
> file include 100000810 || COMMUNITY WEB-PHP PHPBB
> download.php remote file include
> 100000811 || COMMUNITY WEB-PHP PHPBB attach_rules.php remote
> file include
> 100000812 || COMMUNITY WEB-PHP SimpleBoard SBP index.php
> remote file include
> 100000813 || COMMUNITY WEB-PHP SimpleBoard SBP
> file_upload.php remote file include
> 100000814 || COMMUNITY WEB-PHP SimpleBoard SBP
> image_upload.php remote file include
> 100000815 || COMMUNITY WEB-PHP SimpleBoard SBP performs.php
> remote file include
> 100000816 || COMMUNITY WEB-PHP PC_CookBook pccookbook.php
> remote file include
> 100000817 || COMMUNITY WEB-PHP SMF Forum smf.php remote file include
> 100000836 || COMMUNITY WEB-PHP MiniBB com_minibb.php remote
> file include
> 100000837 || COMMUNITY WEB-PHP MiniBB index.php remote file include
> 100000839 || COMMUNITY WEB-PHP PHP Event Calendar
> calendar.php remote file include 100000840 || COMMUNITY
> WEB-PHP FlatNuke index.php remote file include
> 100000841 || COMMUNITY WEB-PHP PerForms performs.php remote
> file include
> 100000847 || COMMUNITY WEB-PHP Sitemap sitemap.xml.php remote
> file include 100000850 || COMMUNITY WEB-PHP IceWarp
> include.php remote file include
> 100000851 || COMMUNITY WEB-PHP IceWarp include.php remote file include
> 100000852 || COMMUNITY WEB-PHP IceWarp include.php remote file include
> 100000853 || COMMUNITY WEB-PHP IceWarp settings.html remote
> file include
> 100000854 || COMMUNITY WEB-PHP ListMessenger
> listmessenger.php remote file include
> 100000861 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote
> file include
> 100000862 || COMMUNITY WEB-PHP FlushCMS class.rich.php remote
> file include
> 100000864 || COMMUNITY WEB-CLIENT tsuserex.dll COM Object
> Instantiation Vulnerability
> 100000865 || COMMUNITY WEB-PHP powergap remote file Inclusion
> Exploit s01
> 100000866 || COMMUNITY WEB-PHP powergap remote file Inclusion
> Exploit s02
> 100000867 || COMMUNITY WEB-PHP powergap remote file Inclusion
> Exploit s03
> 100000868 || COMMUNITY WEB-PHP powergap remote file Inclusion
> Exploit s04
> 100000869 || COMMUNITY WEB-PHP powergap remote file Inclusion
> Exploit sid variant 100000870 || COMMUNITY WEB-PHP powergap
> remote file inclusion exploit sid variant 2
> 100000871 || COMMUNITY WEB-PHP CubeCart XSS attack
> 100000872 || COMMUNITY WEB-PHP CubeCart XSS attack
> 100000873 || COMMUNITY WEB-PHP discloser 0.0.4 Remote File Inclusion
> 100000874 || COMMUNITY MISC DLR-TOR Directory server response
> 100000878 || COMMUNITY WEB-CGI Roller Weblog XSS exploit
> 100000879 || COMMUNITY WEB-CGI Roller Weblog XSS exploit
> 100000880 || COMMUNITY WEB-CGI Roller Weblog XSS exploit
> 100000882 || COMMUNITY WEB-PHP PHP Live Helper globals.php
> remote file include
> 100000883 || COMMUNITY WEB-PHP Inlink remote file inclusion exploit
> 100000884 || COMMUNITY WEB-MISC SimpleBlog Remote SQL
> Injection attempt
> 100000885 || COMMUNITY WEB-PHP pHNews access attempt
> 100000886 || COMMUNITY WEB-PHP Proxima access attempt
> 100000887 || COMMUNITY WEB-PHP pmwiki exploit attempt
> 100000888 || COMMUNITY WEB-PHP tikiwiki exploit attempt
> 100000889 || COMMUNITY WEB-PHP yappa-ng exploit attempt
> 100000892 || COMMUNITY MISC Q.931 Invalid Call Reference
> Length Buffer Overflow
>
> --------------------------------------------------------------
> -----------
> Using Tomcat but need to do more? Need to support web
> services, security?
> Get stuff done quickly with -integrated technology to make
> your job easier Download IBM WebSphere Application Server
> v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&
> dat=121642
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@lists.sourceforge.net /> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
>
>

[Snort-sigs] Rule Edit: COMMUNITY BOT GTBot ver command

From: Blake Hartstein <bhartstein@de...> - 2006-10-20 22:50

Hi,
In favor of better performance, you can use a negative look behind
instead of a direct negative match as the first check in a pcre. This
allows the pcre check to finish quicker. I felt this was particularly
important if you want to use this rule, since it happens to look on any
port.

Before: (avg/check 427.9 microseconds)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
ver command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"ver"; pcre:"/[^a-zA-Z0-9\x3A\s]ver/"; classtype:
trojan-activity; sid:100000272; rev:2;)

After: (avg/check 28.3 microseconds)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
ver command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"ver"; pcre:"/(?<![a-zA-Z0-9\x3A\s])ver/"; classtype:
trojan-activity; sid:100000272; rev:3;)

This improvement applies to :
100000272 "/[^a-zA-Z0-9\x3A\s]ver/"
100000273 "/[^a-zA-Z0-9\x3A\s]info/"
100000274 "/[^a-zA-Z0-9\x3A\s]scan/"
100000275 "/[^a-zA-Z0-9\x3A\s]portscan/"
100000276 "/[^a-zA-Z0-9\x3A\s]stopscan/"
100000277 "/[^a-zA-Z0-9\x3A\s]packet/"
100000278 "/[^a-zA-Z0-9\x3A\s]bnc/"

The new rules are:
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
ver command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"ver"; pcre:"/(?<![a-zA-Z0-9\x3A\s])ver/"; classtype:
trojan-activity; sid:100000272; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
info command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"info"; pcre:"/(?<![a-zA-Z0-9\x3A\s])info/"; classtype:
trojan-activity; sid:100000273; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
scan command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"scan"; pcre:"/(?<![a-zA-Z0-9\x3A\s])scan/"; classtype:
trojan-activity; sid:100000274; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
portscan command"; flow: established;
flowbits:isset,community_is_proto_irc; content:"portscan";
pcre:"/(?<![a-zA-Z0-9\x3A\s])portscan/"; classtype: trojan-activity;
sid:100000275; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
stopscan command"; flow: established;
flowbits:isset,community_is_proto_irc; content:"stopscan";
pcre:"/(?<![a-zA-Z0-9\x3A\s])stopscan/"; classtype: trojan-activity;
sid:100000276; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
packet command"; flow: established;
flowbits:isset,community_is_proto_irc; content:"packet";
pcre:"/(?<![a-zA-Z0-9\x3A\s])packet/"; classtype: trojan-activity;
sid:100000277; rev:3;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"COMMUNITY BOT GTBot
bnc command"; flow: established; flowbits:isset,community_is_proto_irc;
content:"bnc"; pcre:"/(?<![a-zA-Z0-9\x3A\s])bnc/"; classtype:
trojan-activity; sid:100000278; rev:3;)

-Blake

--
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain information that is confidential and privileged. If you receive this email in error, please advise us by return email immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately. Demarc Security, Inc. does not accept liability for the views exssed in the email or for the consequences of any computer viruses that may be transmitted with this email.

This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written consent of the copyright owner.

Next Messages

Snort

Email Archive: snort-sigs (read-only)

About SourceForge

Find Software

Develop Software

Community

Help