jj
[***] Results from Oinkmaster started Thu Aug 26 20:00:01 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (4):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Agent";
classtype:trojan-activity; uricontent:"/pops=1/site="; nocase;
uricontent:"/bnum="; nocase; sid:2001226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post";
classtype:trojan-activity; uricontent:"/Games/cakedeal.aspx"; nocase; nocase;
sid:2001230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post";
classtype:trojan-activity; uricontent:"/Games/villains.aspx"; nocase; nocase;
sid:2001228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Statblaster Receiving New configuration";
classtype:trojan-activity; uricontent:"/updatestats/update"; nocase;
uricontent:".xml"; nocase; sid:2001225; rev:1;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (4):
2001225 || BLEEDING-EDGE Malware Statblaster Receiving New configuration
2001226 || BLEEDING-EDGE Malware Unknown Advertising.com Agent
2001228 || BLEEDING-EDGE Malware Unknown Advertising.com Data Post
2001230 || BLEEDING-EDGE Malware Unknown Advertising.com Data Post
[*] Added files: [*]
None.
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
