[***] Results from Oinkmaster started Fri Sep 3 20:00:02 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding.rules (25):
#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
IRC dns response"; flow:to_client,established; content:"|3A|"; offset:0;
content:" 302 "; content:"=+"; classtype:policy-violation; priority:1;
sid:2001252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN user search"; flow:to_server,established; content:"CAL "; depth:4; nocase;
classtype:policy-violation; priority:1; sid:2001244; rev:1;)
#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC channel join"; flow:to_server,established; content:"JOIN |3A| |23|";
offset:0; nocase; classtype:policy-violation; priority:1; sid:2001249; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference watch"; flow:from_server,established; content:"|0D 00 05
00|"; depth:4; classtype:policy-violation; priority:1; sid:2001264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference request"; flow:to_server,established; content:"<R";
depth:2; pcre:"/^\x3c(REQIMG|RVWCFG)\x3e/ism"; classtype:policy-violation;
priority:1; sid:2001263; rev:1;)
#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC DCC file transfer request"; flow:to_server,established; content:"PRIVMSG ";
offset:0; nocase; content:" |3A|.DCC SEND"; nocase; classtype:policy-violation;
priority:1;sid:2001247; rev:1;)
#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC nick change"; flow:to_server,established; content:"NICK "; offset:0;
classtype:policy-violation; priority:1; sid:2001246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM ping"; flow:to_server,established; content:"YMSG"; depth:4; nocase;
content:"|00 12|"; depth:2; offset:10; classtype:policy-violation;
priority:1;sid:2001255; rev:2;)
alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN file transfer request"; flow:established; content:"MSG "; depth:4;
content:"Content-Type|3A|"; distance:0; nocase; content:"text/x-msmsgsinvite";
distance:0; nocase; content:"Application-Name|3A|"; content:"File Transfer";
distance:0; nocase; classtype:policy-violation; priority:1; sid:2001241; rev:1;)
#alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC message"; flow:established; content:"PRIVMSG "; nocase;
classtype:policy-violation; priority:1;sid:2001250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN login attempt"; flow:to_server,established; content:"USR "; depth:4;
nocase; content:" TWN "; distance:1; nocase; classtype:policy-violation;
priority:1; sid:2001245; rev:1;)
#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC DCC chat request"; flow:to_server,established; content:"PRIVMSG ";
offset:0; nocase; content:" |3A|.DCC CHAT chat"; nocase;
classtype:policy-violation; priority:1; sid:2001248; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference invitation"; flow:from_server,established; content:"YMSG";
depth:4; nocase; content:"|00 18|"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001256; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM successful chat join"; flow:from_server,established; content:"YMSG";
depth:4; nocase; content:"|00 98|"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference offer invitation"; flow:to_server,established;
content:"YMSG"; depth:4; nocase; content:"|00|P"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001262; rev:1;)
alert tcp any any -> any any (msg:"BLEEDING-EDGE CHAT Yahoo IM file
transfer request"; flow:established; content:"YMSG"; depth:4; nocase;
content:"|00|M"; depth:2; offset:10; classtype:policy-violation; priority:1;
sid:2001259; rev:1;)
alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN file transfer reject"; flow:established; content:"MSG "; depth:4;
content:"Content-Type|3A|"; nocase; content:"text/x-msmsgsinvite"; distance:0;
content:"Invitation-Command|3A|"; content:"CANCEL"; distance:0;
content:"Cancel-Code|3A|"; nocase; content:"REJECT"; distance:0; nocase;
classtype:policy-violation; priority:1; sid:2001243; rev:1;)
alert tcp any any <> any any (msg:"BLEEDING-EDGE CHAT Yahoo IM
message"; flow:established; content:"YMSG"; depth:4;
classtype:policy-violation; priority:1; sid:2001260; rev:1;)
#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
IRC dns request"; flow:to_server,established; content:"USERHOST "; offset:0;
nocase; classtype:policy-violation; priority:1; sid:2001251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference message"; flow:to_server,established; content:"YMSG";
depth:4; nocase; content:"|00 1D|"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001258; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM successful logon"; flow:from_server,established; content:"YMSG";
depth:4; nocase; content:"|00 01|"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001253; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM voicechat"; flow:from_server,established; content:"YMSG"; depth:4;
nocase; content:"|00|J"; depth:2; offset:10; classtype:policy-violation;
priority:1; sid:2001254; rev:1;)
alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN message"; flow:established; content:"MSG "; depth:4;
content:"Content-Type|3A|"; nocase; content:"text/plain"; distance:1;
classtype:policy-violation; priority:1; sid:2001265; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE CHAT
Yahoo IM conference logon success"; flow:from_server,established;
content:"YMSG"; depth:4; nocase; content:"|00 19|"; depth:2; offset:10;
classtype:policy-violation; priority:1; sid:2001257; rev:1;)
alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"BLEEDING-EDGE CHAT
MSN file transfer accept"; flow:established; content:"MSG "; depth:4;
content:"Content-Type|3A|"; nocase; content:"text/x-msmsgsinvite"; distance:0;
content:"Invitation-Command|3A|"; content:"ACCEPT"; distance:1;
classtype:policy-violation; priority:1; sid:2001242; rev:1;)
[---] Disabled rules: [---]
-> Disabled in bleeding-malware.rules (1):
#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE IE spyware downloader prompt.php";
pcre:"/document\.write[\s]*\([\s]*["'](%[0-9a-fA-F]{1,2}){20}/i"; reference:
url, http.www.giac.org/practical/GCIH/Franklin_Witter_GCIH.pdf;
classtype:misc-attack; sid:2000512; rev:3;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (18):
2001241 || BLEEDING-EDGE CHAT MSN file transfer request
2001242 || BLEEDING-EDGE CHAT MSN file transfer accept
2001243 || BLEEDING-EDGE CHAT MSN file transfer reject
2001244 || BLEEDING-EDGE CHAT MSN user search
2001245 || BLEEDING-EDGE CHAT MSN login attempt
2001253 || BLEEDING-EDGE CHAT Yahoo IM successful logon
2001254 || BLEEDING-EDGE CHAT Yahoo IM voicechat
2001255 || BLEEDING-EDGE CHAT Yahoo IM ping
2001256 || BLEEDING-EDGE CHAT Yahoo IM conference invitation
2001257 || BLEEDING-EDGE CHAT Yahoo IM conference logon success
2001258 || BLEEDING-EDGE CHAT Yahoo IM conference message
2001259 || BLEEDING-EDGE CHAT Yahoo IM file transfer request
2001260 || BLEEDING-EDGE CHAT Yahoo IM message
2001261 || BLEEDING-EDGE CHAT Yahoo IM successful chat join
2001262 || BLEEDING-EDGE CHAT Yahoo IM conference offer invitation
2001263 || BLEEDING-EDGE CHAT Yahoo IM conference request
2001264 || BLEEDING-EDGE CHAT Yahoo IM conference watch
2001265 || BLEEDING-EDGE CHAT MSN message
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (1):
2000512 || BLEEDING-EDGE IE spyware downloader prompt.php || url,
http.www.giac.org/practical/GCIH/Franklin_Witter_GCIH.pdf
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
