[***] Results from Oinkmaster started Fri Sep 10 20:00:01 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (3):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Gator/Clarian Agent";
uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:trojan-activity;
sid:2001306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Wild Tangent Agent Installation";
uricontent:"/Recovery/Checkin.aspx?version"; nocase; classtype:trojan-activity;
sid:2001307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Internet Optomizer Reporting Data";
uricontent:"/io/downloads/"; nocase; content:"/wsi8/optimize"; nocase;
classtype:trojan-activity; sid:2001308; rev:1;)
[+++] Enabled rules: [+++]
-> Enabled in bleeding.rules (1):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Yahoo Mail Message Compose Open";
flow:to_server,established; uricontent:"/ym/Compose"; nocase; classtype:
policy-violation; sid:2000043; rev:7;)
[///] Modified active rules: [///]
-> Modified active in bleeding-malware.rules (3):
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MyWebSearch Toolbar Receiving Configuration";
classtype:trojan-activity; uricontent:"/myspeedbarcfg2.jsp?s="; sid:2000600;
rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MyWebSearch Toolbar Receiving Configuration";
classtype:trojan-activity; uricontent:"/myspeedbarcfg2.jsp?"; sid:2000600;
rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Browseraid.com Agent Reporting Data";
classtype:trojan-activity; reference:url,www.browseraid.com; content:"POST ";
nocase; content:"/perl/ads.pl"; nocase; content:"action=any"; nocase;
content:"county="; nocase; sid:2001266; rev:3;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Browseraid.com Agent Reporting Data";
classtype:trojan-activity; reference:url,www.browseraid.com; content:"POST ";
nocase; uricontent:"/perl/ads.pl"; nocase; content:"browseraid.com"; nocase;
sid:2001266; rev:4;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Browseraid.com Agent Updating";
classtype:trojan-activity; reference:url,www.browseraid.com;
uricontent:"/perl/uptodate.pl"; nocase; content:"User-Agent\: Windows
UpToDate"; nocase; sid:2001304; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Browseraid.com Agent Updating";
classtype:trojan-activity; reference:url,www.browseraid.com;
uricontent:"/perl/uptodate.pl"; nocase; content:"uptodate.browseraid.com";
nocase; sid:2001304; rev:2;)
[///] Modified inactive rules: [///]
-> Modified inactive in bleeding.rules (1):
old: #alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Yahoo Mail Inbox View"; flow:to_server,established;
uricontent:"/ym/ShowFolder"; nocase; content"rb=Inbox"; nocase; classtype:
policy-violation; sid:2000041; rev:8;)
new: #alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Yahoo Mail Inbox View"; flow:to_server,established;
uricontent:"/ym/ShowFolder"; nocase; content:"rb=Inbox"; nocase; classtype:
policy-violation; sid:2000041; rev:8;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (4):
2000043 || BLEEDING-EDGE Yahoo Mail Message Compose Open
2001306 || BLEEDING-EDGE Malware Gator/Clarian Agent
2001307 || BLEEDING-EDGE Malware Wild Tangent Agent Installation
2001308 || BLEEDING-EDGE Malware Internet Optomizer Reporting Data
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
